Skip to content

Fix OAuth2 authorization code expiry and reuse handling#36797

Merged
lunny merged 11 commits intogo-gitea:mainfrom
lunny:lunny/fix_oauth2
Mar 6, 2026
Merged

Fix OAuth2 authorization code expiry and reuse handling#36797
lunny merged 11 commits intogo-gitea:mainfrom
lunny:lunny/fix_oauth2

Conversation

@lunny
Copy link
Copy Markdown
Member

@lunny lunny commented Mar 2, 2026

  • set OAuth2 authorization code ValidUntil on creation and add expiry checks during exchange
  • return a specific error when codes are invalidated twice to prevent concurrent reuse
  • add unit tests covering validity timestamps, expiration, and double invalidation

Generate by a coding agent with Codex 5.2

@lunny lunny added type/bug backport/v1.25 This PR should be backported to Gitea 1.25 labels Mar 2, 2026
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Mar 2, 2026
@github-actions github-actions bot added the modifies/go Pull requests that update Go code label Mar 2, 2026
@silverwind silverwind requested a review from Copilot March 2, 2026 06:57
Copilot AI reviewed Mar 2, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR tightens OAuth2 authorization-code handling by ensuring codes have a defined lifetime, enforcing expiry during exchange, and improving concurrent “double use” detection to better align with RFC 6749 expectations.

Changes:

  • Set ValidUntil when generating new OAuth2 authorization codes and add an IsExpired() helper.
  • Enforce authorization-code expiry during the access-token exchange and return invalid_grant for expired codes.
  • Make Invalidate() detect double invalidation (concurrent reuse) and add unit tests for validity, expiry, and double invalidation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
routers/web/auth/oauth2_provider.go Adds expiry check during code exchange and maps “already invalidated” to a clearer OAuth error.
models/auth/oauth2.go Introduces authorization-code validity window, expiry logic, and double-invalidation detection.
models/auth/oauth2_test.go Adds unit tests validating ValidUntil, IsExpired(), and double invalidation behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wxiaoguang
wxiaoguang reviewed Mar 2, 2026
View reviewed changes
@silverwind
Copy link
Copy Markdown
Member

silverwind commented Mar 2, 2026

Is this related to #28394?

@lunny
Copy link
Copy Markdown
Member Author

lunny commented Mar 2, 2026

Is this related to #28394?

No, this is a new report. The OAuth2 code expiration time has never been used.

lunny and others added 5 commits March 1, 2026 23:51
@lunny
Update routers/web/auth/oauth2_provider.go
e6b6b02 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>
@lunny
Update models/auth/oauth2.go
05f6963 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>
@lunny
adjustment
a54edef
@lunny
Fix test
b6ee170
@lunny
Merge branch 'main' into lunny/fix_oauth2
a4cb454
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Mar 5, 2026
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Mar 5, 2026
@lunny lunny added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Mar 5, 2026
@lunny lunny enabled auto-merge (squash) March 6, 2026 04:48
@lunny lunny merged commit f3bdcc5 into go-gitea:main Mar 6, 2026
26 checks passed
@GiteaBot GiteaBot added this to the 1.26.0 milestone Mar 6, 2026
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Mar 6, 2026
@lunny lunny deleted the lunny/fix_oauth2 branch March 6, 2026 05:12
silverwind added a commit to silverwind/gitea that referenced this pull request Mar 6, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into fixmerge
f626aa0 
* origin/main: (27 commits)
  Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797)
  Fix org permission API visibility checks for hidden members and private orgs (go-gitea#36798)
  Fix non-admins unable to automerge PRs from forks (go-gitea#36833)
  upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (go-gitea#36837)
  Fix dump release asset bug (go-gitea#36799)
  build(deps): update material-icon-theme v5.32.0 (go-gitea#36832)
  Fix bug to check whether user can update pull request branch or rebase branch (go-gitea#36465)
  Fix forwarded proto handling for public URL detection (go-gitea#36810)
  Fix artifacts v4 backend upload problems (go-gitea#36805)
  Add a git grep search timeout (go-gitea#36809)
  fix(repo): unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (go-gitea#36597)
  Harden render iframe open-link handling (go-gitea#36811)
  [skip ci] Updated translations via Crowdin
  fix: /repos/{owner}/{repo}/actions/{runs,jobs} requiring owner permissions (go-gitea#36818)
  Fix CRAN package version validation to allow more than 4 version components (go-gitea#36813)
  Fix API not persisting pull request unit config when has_pull_requests is not set (go-gitea#36718)
  feat: Add Actions API rerun endpoints for runs and jobs (go-gitea#36768)
  Fix bug when pushing mirror with wiki (go-gitea#36795)
  Pull Request Pusher should be the author of the merge (go-gitea#36581)
  Delete non-exist branch should return 404 (go-gitea#36694)
  ...

# Conflicts:
#	routers/web/repo/issue_view.go
GiteaBot pushed a commit to GiteaBot/gitea that referenced this pull request Mar 6, 2026
@lunny @GiteaBot
Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797)
d86ef07 
- set OAuth2 authorization code `ValidUntil` on creation and add expiry
checks during exchange
- return a specific error when codes are invalidated twice to prevent
concurrent reuse
- add unit tests covering validity timestamps, expiration, and double
invalidation

---
Generate by a coding agent with Codex 5.2

---------

Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@GiteaBot GiteaBot mentioned this pull request Mar 6, 2026
Merged
@GiteaBot GiteaBot added the backport/done All backports for this PR have been created label Mar 6, 2026
lunny added a commit that referenced this pull request Mar 6, 2026
@GiteaBot @lunny
Fix OAuth2 authorization code expiry and reuse handling (#36797) (#36851
413074b 
)

Backport #36797 by @lunny

- set OAuth2 authorization code `ValidUntil` on creation and add expiry
checks during exchange
- return a specific error when codes are invalidated twice to prevent
concurrent reuse
- add unit tests covering validity timestamps, expiration, and double
invalidation

---
Generate by a coding agent with Codex 5.2

Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
silverwind added a commit to silverwind/gitea that referenced this pull request Mar 6, 2026
@silverwind
Merge branch 'main' into up
d623eae 
* main:
  Fix dbfs error handling (go-gitea#36844)
  Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797)
  Fix org permission API visibility checks for hidden members and private orgs (go-gitea#36798)
  Fix non-admins unable to automerge PRs from forks (go-gitea#36833)
  upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (go-gitea#36837)

# Conflicts:
#	go.mod
#	go.sum
silverwind added a commit to silverwind/gitea that referenced this pull request Mar 8, 2026
@silverwind
Merge branch 'main' into cm
8df7e3f 
* main: (26 commits)
  Clean up `refreshViewedFilesSummary` (go-gitea#36868)
  Remove `util.URLJoin` and replace all callers with direct path concatenation (go-gitea#36867)
  Optimize Docker build with dependency layer caching (go-gitea#36864)
  Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (go-gitea#36861)
  Fix CodeQL code scanning alerts (go-gitea#36858)
  Refactor auth middleware (go-gitea#36848)
  Update Nix flake (go-gitea#36857)
  Update JS deps (go-gitea#36850)
  Load `mentionValues` asynchronously (go-gitea#36739)
  [skip ci] Updated translations via Crowdin
  Fix dbfs error handling (go-gitea#36844)
  Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797)
  Fix org permission API visibility checks for hidden members and private orgs (go-gitea#36798)
  Fix non-admins unable to automerge PRs from forks (go-gitea#36833)
  upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (go-gitea#36837)
  Fix dump release asset bug (go-gitea#36799)
  build(deps): update material-icon-theme v5.32.0 (go-gitea#36832)
  Fix bug to check whether user can update pull request branch or rebase branch (go-gitea#36465)
  Fix forwarded proto handling for public URL detection (go-gitea#36810)
  Fix artifacts v4 backend upload problems (go-gitea#36805)
  ...

# Conflicts:
#	pnpm-lock.yaml
zjjhot added a commit to zjjhot/gitea that referenced this pull request Mar 10, 2026
@zjjhot
Merge remote-tracking branch 'giteaofficial/main'
4deb62b 
* giteaofficial/main:
  Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (go-gitea#36876)
  Add render cache for SVG icons (go-gitea#36863)
  Fix incorrect viewed files counter if reverted change was viewed (go-gitea#36819)
  [skip ci] Updated translations via Crowdin
  Clean up `refreshViewedFilesSummary` (go-gitea#36868)
  Remove `util.URLJoin` and replace all callers with direct path concatenation (go-gitea#36867)
  Optimize Docker build with dependency layer caching (go-gitea#36864)
  Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (go-gitea#36861)
  Fix CodeQL code scanning alerts (go-gitea#36858)
  Refactor auth middleware (go-gitea#36848)
  Update Nix flake (go-gitea#36857)
  Update JS deps (go-gitea#36850)
  Load `mentionValues` asynchronously (go-gitea#36739)
  [skip ci] Updated translations via Crowdin
  Fix dbfs error handling (go-gitea#36844)
  Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797)
  Fix org permission API visibility checks for hidden members and private orgs (go-gitea#36798)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wxiaoguang wxiaoguang wxiaoguang left review comments

Copilot code review Copilot Copilot left review comments

@silverwind silverwind silverwind approved these changes

@Zettat123 Zettat123 Zettat123 approved these changes

Assignees

No one assigned

Labels

backport/done All backports for this PR have been created backport/v1.25 This PR should be backported to Gitea 1.25 lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. modifies/go Pull requests that update Go code type/bug

Projects

None yet

Milestone

1.26.0

Development

Successfully merging this pull request may close these issues.

6 participants

@lunny @silverwind @wxiaoguang @Zettat123 @GiteaBot