[Feature] Security improvement when using OAuth Application Tokens (CI, Drone, etc). #7408

New Issue

GiteaMirror · 2025-11-02T07:25:05-06:00

GiteaMirror commented

2025-11-02 07:25:05 -06:00

Originally created by @gnat on GitHub (May 29, 2021).

Currently, CI systems and apps integrate with Gitea using "full access" OAuth Application / Access Tokens.

Unfortunately this is a security issue as the tokens have full access to every repository- this has fairly serious implications if any app using these tokens is compromised.

To keep things simple, I propose an easy way to add access control:

New checkbox setting on each repository, whether or not it's accessible to OAuth Applications.

This has a nice side effect of cleaning up repositories from the build list when using automated CI systems such as Drone.

Thanks!

Originally created by @gnat on GitHub (May 29, 2021). Currently, CI systems and apps integrate with Gitea using "full access" OAuth Application / Access Tokens. Unfortunately this is a security issue as the tokens have full access to every repository- this has fairly serious implications if any app using these tokens is compromised. To keep things simple, I propose an easy way to add access control: * New checkbox setting on each repository, whether or not it's accessible to OAuth Applications. This has a nice side effect of cleaning up repositories from the build list when using automated CI systems such as Drone. Thanks!

GiteaMirror added the type/proposal topic/authentication labels 2025-11-02 07:25:05 -06:00

GiteaMirror commented

2025-11-02 07:25:06 -06:00

@gnat commented on GitHub (May 29, 2021):

Also I believe this has been proposed years ago in the past (granular access controls for OAuth Access Tokens, read/write, etc.), but proposals have looked super complicated to the point where I fear we may never see this feature. The above would get us there for the vast majority of gitea users with less effort, be easy to document and use.

@gnat commented on GitHub (May 29, 2021): Also I believe this has been proposed years ago in the past (granular access controls for OAuth Access Tokens, read/write, etc.), but proposals have looked super complicated to the point where I fear we may never see this feature. The above would get us there for the vast majority of gitea users with less effort, be easy to document and use.

GiteaMirror commented

2025-11-02 07:25:06 -06:00

@a1012112796 commented on GitHub (May 31, 2021):

releated to #4300

@a1012112796 commented on GitHub (May 31, 2021): releated to #4300

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#7408