Description

Gogs: Access tokens get exposed through URL params in API requests

Summary

The Gogs API still accepts tokens in URL parameters such as token and access_token, which can leak through logs, browser history, and referrers.

Details

A static review shows that the API still checks tokens in the URL query before looking at headers:

internal/context/auth.go reads c.Query("token")

internal/context/auth.go falls back to c.Query("access_token")

internal/context/auth.go only checks the Authorization header when the query token is empty

internal/context/auth.go authenticates using that token and marks the request as token-authenticated

Token-authenticated requests are accepted by API routes through c.IsTokenAuth checks:

internal/route/api/v1/api.go

Impact

If tokens are sent in URLs such as /api/v1/user?token=..., they can leak in logs, browser or shell history, and referrer headers, and can be reused until revoked.

Recommended Fix

Authentication headers should be used exclusively for token transmission.

Token parameters should be blocked at the proxy or WAF level.

Query strings should be scrubbed from logs.

A strict referrer policy should be set.

Remediation

A fix is available at https://github.com/gogs/gogs/releases/tag/v0.14.2.

Mitigation

Aliases

References