tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-10-31 11:28:24 +00:00
Code Releases Activity

Use general token signing secret (#29205) (#29325)

Browse Source 
Backport #29205 (including #29172)

Use a clearly defined "signing secret" for token signing.
This commit is contained in:
wxiaoguang
2024-02-23 01:07:41 +08:00
committed by GitHub
parent 7ea2ffaf16
commit 511298e452
13 changed files with 130 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
services/packages/auth.go
View File

@@ -33,7 +33,7 @@ func CreateAuthorizationToken(u *user_model.User) (string, error) {
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
tokenString, err := token.SignedString([]byte(setting.SecretKey))
tokenString, err := token.SignedString(setting.GetGeneralTokenSigningSecret())
if err != nil {
return "", err
}
@@ -57,7 +57,7 @@ func ParseAuthorizationToken(req *http.Request) (int64, error) {
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
}
return []byte(setting.SecretKey), nil
return setting.GetGeneralTokenSigningSecret(), nil
})
if err != nil {
return 0, err