leon/Forge-Pages-Action
Watch
1
0
Fork
You've already forked Forge-Pages-Action
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Send the deploy token via Authorization header, not the URL query #1

Open
Leon Schmidt wants to merge 2 commits from chore/security-hardening into main
pull from: chore/security-hardening
merge into: leon:main
Conversation 1 Commits 2 Files changed 1 +3 -2
Leon Schmidt commented 2026-07-28 21:19:17 +02:00
Owner
Copy link

The token was appended to the deploy URL as ?access_token=..., which leaks it into server, reverse-proxy, and CI logs. Send it in an Authorization: Bearer header instead.

Repo/protect/additional_base_path stay as query parameters (they are not secret).

Contributed by Michal Bielicki.

The token was appended to the deploy URL as ?access_token=..., which leaks it into server, reverse-proxy, and CI logs. Send it in an Authorization: Bearer header instead. Repo/protect/additional_base_path stay as query parameters (they are not secret). Contributed by **Michal Bielicki**.
The token was appended to the deploy URL as ?access_token=..., which
leaks it into server, reverse-proxy, and CI logs. Send it in an
Authorization: Bearer header instead; repo/protect/additional_base_path
stay as query parameters (they are not secret). Matches the server
change that rejects a query-string token with 410.
Leon Schmidt commented 2026-07-28 21:49:17 +02:00
Author
Owner
Copy link

This is definitely a useful addition. I will merge it once Forge-Pages supports the token to be sent as a Bearer token.

This is definitely a useful addition. I will merge it once Forge-Pages supports the token to be sent as a Bearer token.
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin chore/security-hardening:chore/security-hardening
git switch chore/security-hardening

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff chore/security-hardening
git switch chore/security-hardening
git rebase main
git switch main
git merge --ff-only chore/security-hardening
git switch chore/security-hardening
git rebase main
git switch main
git merge --no-ff chore/security-hardening
git switch main
git merge --squash chore/security-hardening
git switch main
git merge --ff-only chore/security-hardening
git switch main
git merge chore/security-hardening
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
Leon Schmidt
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
leon/Forge-Pages-Action!1
No description provided.