diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go index b2c3c8bfda..a60552d590 100644 --- a/routers/api/v1/api.go +++ b/routers/api/v1/api.go @@ -56,7 +56,7 @@ // description: Sudo API request as the user provided as the key. Admin privileges are required. // TOTPHeader: // type: apiKey -// name: X-GITEA-OTP +// name: X-FORGEJO-OTP // in: header // description: Must be used in combination with BasicAuth if two-factor authentication is enabled. // diff --git a/services/auth/basic.go b/services/auth/basic.go index 5e41730626..d8fce52a69 100644 --- a/services/auth/basic.go +++ b/services/auth/basic.go @@ -144,6 +144,14 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore return u, nil } +func getOtpHeader(header http.Header) string { + otpHeader := header.Get("X-Gitea-OTP") + if forgejoHeader := header.Get("X-Forgejo-OTP"); forgejoHeader != "" { + otpHeader = forgejoHeader + } + return otpHeader +} + func validateTOTP(req *http.Request, u *user_model.User) error { twofa, err := auth_model.GetTwoFactorByUID(u.ID) if err != nil { @@ -153,7 +161,7 @@ func validateTOTP(req *http.Request, u *user_model.User) error { } return err } - if ok, err := twofa.ValidateTOTP(req.Header.Get("X-Gitea-OTP")); err != nil { + if ok, err := twofa.ValidateTOTP(getOtpHeader(req.Header)); err != nil { return err } else if !ok { return util.NewInvalidArgumentErrorf("invalid provided OTP") diff --git a/templates/swagger/v1_json.tmpl b/templates/swagger/v1_json.tmpl index 32e18a56f9..7c3a016154 100644 --- a/templates/swagger/v1_json.tmpl +++ b/templates/swagger/v1_json.tmpl @@ -23142,7 +23142,7 @@ "TOTPHeader": { "description": "Must be used in combination with BasicAuth if two-factor authentication is enabled.", "type": "apiKey", - "name": "X-GITEA-OTP", + "name": "X-FORGEJO-OTP", "in": "header" }, "Token": { diff --git a/tests/integration/api_twofa_test.go b/tests/integration/api_twofa_test.go index 8ceacf729a..8a3cadf3c6 100644 --- a/tests/integration/api_twofa_test.go +++ b/tests/integration/api_twofa_test.go @@ -51,4 +51,9 @@ func TestAPITwoFactor(t *testing.T) { req = AddBasicAuthHeader(req, user.Name) req.Header.Set("X-Gitea-OTP", passcode) MakeRequest(t, req, http.StatusOK) + + req = NewRequestf(t, "GET", "/api/v1/user") + req = AddBasicAuthHeader(req, user.Name) + req.Header.Set("X-Forgejo-OTP", passcode) + MakeRequest(t, req, http.StatusOK) }