gitea/docs/content/doc/development
Denys Konovalov 7d855efb1f
Allow for PKCE flow without client secret + add docs (#25033)
The PKCE flow according to [RFC
7636](https://datatracker.ietf.org/doc/html/rfc7636) allows for secure
authorization without the requirement to provide a client secret for the
OAuth app.

It is implemented in Gitea since #5378 (v1.8.0), however without being
able to omit client secret.
Since #21316 Gitea supports setting client type at OAuth app
registration.

As public clients are already forced to use PKCE since #21316, in this
PR the client secret check is being skipped if a public client is
detected. As Gitea seems to implement PKCE authorization correctly
according to the spec, this would allow for PKCE flow without providing
a client secret.

Also add some docs for it, please check language as I'm not a native
English speaker.

Closes #17107
Closes #25047
2023-06-03 05:59:28 +02:00
..
_index.en-us.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
_index.zh-cn.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
_index.zh-tw.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
api-usage.en-us.md Harmonize title formatting in `docs/content/doc/development/api-usage.en-us.md` (#24529) 2023-05-05 03:11:54 +00:00
api-usage.zh-cn.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
hacking-on-gitea.en-us.md Unify doc links to use paths relative to doc folder (#24979) 2023-05-29 13:27:16 +00:00
hacking-on-gitea.zh-cn.md Unify doc links to use paths relative to doc folder (#24979) 2023-05-29 13:27:16 +00:00
integrations.en-us.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
integrations.zh-cn.md Add Chinese docs for help, contribution and development (#24925) 2023-05-25 16:01:01 +00:00
integrations.zh-tw.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
migrations.en-us.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
migrations.zh-cn.md Add Chinese docs for help, contribution and development (#24925) 2023-05-25 16:01:01 +00:00
migrations.zh-tw.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
oauth2-provider.en-us.md Allow for PKCE flow without client secret + add docs (#25033) 2023-06-03 05:59:28 +02:00
oauth2-provider.zh-cn.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00
oauth2-provider.zh-tw.md Refactor docs (#23752) 2023-04-28 11:33:41 +08:00