Gitea: Disable HTTPS Push method for GIT #30

New Issue

Arnd Marijnissen · 2023-02-14T11:23:04+01:00

Arnd Marijnissen commented

2023-02-14 11:23:04 +01:00

Taken from #3

We want to have people able to PULL via HTTPS (unauthenticated) but would prefer to have only SSH-keys being used as a method to PUSH anything.

This involves finding a way to disable https method in a graceful way.

Allowing https-logins creates a number of issues:

We want to only have one set of login-data for user-accounts: blender-id
HTTPS-git only really works against LOCAL password in GItea (which we'd like to NOT have used)
Local-passwords can currently be set by using the 'forgot password' path.. so people can actually set them..)

Disabling authenticated HTTPS-push methods will prevent people from using this in production.

Goals:

We want to KEEP https PULLS
We want to DISABLE https PUSH
We want to discourage/remove any operations involving 'local password"
- Password reset system needs looking at, too

Taken from #3 We want to have people able to PULL via HTTPS (unauthenticated) but would prefer to have only SSH-keys being used as a method to PUSH anything. This involves finding a way to disable https method in a graceful way. Allowing https-logins creates a number of issues: * We want to only have one set of login-data for user-accounts: blender-id * HTTPS-git only really works against LOCAL password in GItea (which we'd like to NOT have used) * Local-passwords can currently be set by using the 'forgot password' path.. so people can actually set them..) Disabling authenticated HTTPS-push methods will prevent people from using this in production. Goals: * We want to KEEP https PULLS * We want to DISABLE https PUSH * We want to discourage/remove any operations involving 'local password" * Password reset system needs looking at, too

Arnd Marijnissen added the

labels 2023-02-14 11:23:27 +01:00

Arnd Marijnissen referenced this issue

2023-02-14 11:44:27 +01:00

Configuration of Production Server #3

Lunny Xiao commented

2023-02-18 04:00:01 +01:00

I already have a PR to allow disable change local password and some other parts. https://github.com/go-gitea/gitea/pull/20549