feat(oauth): Support AWS Cognito OAuth2 provider#37607
Merged
Merged
Conversation
GiteaBot
added
the
lgtm/need 2
thatguyfig
changed the title
thatguyfig
changed the title
wxiaoguang
previously approved these changes
May 10, 2026
GiteaBot
added
lgtm/need 1
Contributor
Author
|
On second look, I think a better approach would be to setup a Goth provider much like the other custom oauth implementations rather than overriding. I'll update to follow the pattern already implemented |
GiteaBot
added
lgtm/need 2
Contributor
Author
|
In the end it wasn't that simple to do, instead i've moved the cognito provider registration into same file as the custom providers. The approach is still largely the same as before. |
wxiaoguang
approved these changes
May 11, 2026
GiteaBot
added
lgtm/need 1
bircni
approved these changes
May 16, 2026
GiteaBot
added
lgtm/done
bircni
added
the
reviewed/wait-merge
GiteaBot
removed
the
reviewed/wait-merge
Contributor
Author
|
Nice one cheers! |
silverwind
added a commit
to silverwind/gitea
that referenced
this pull request
May 18, 2026
* origin/main: (39 commits) fix: Add missed token scope checking (go-gitea#37735) chore: Use giteabot instead of backporter (go-gitea#37422) fix: Allow direct commits for unprotected files with push restrictions (go-gitea#37657) chore: Conventional adjustments (go-gitea#37677) chore(db): introduce db.Session and db.EngineMigration interfaces (go-gitea#37746) fix(migrations): preserve unique constraints in v334 sync (go-gitea#37743) feat(web): also display PR counts in repo list (go-gitea#37739) feat: execute post run cleanup when workflow is cancelled (go-gitea#37275) fix(actions): wrong assumption that run id always >= job id (go-gitea#37737) fix(icon): use repo-forked icon to display forks count (go-gitea#37731) fix(oauth): strengthen PKCE validation and refresh token replay protection (go-gitea#37706) fix(web): enforce token scopes on raw, media, and attachment downloads (go-gitea#37698) feat: Add bypass allowlist for branch protection (go-gitea#36514) refactor(glob): use strings.Builder for regexp compilation (go-gitea#37730) feat(oauth): Support AWS Cognito OAuth2 provider (go-gitea#37607) feat: Add default PR branch update style setting (go-gitea#37410) refactor: move `workflowpattern` into `modules/actions` (go-gitea#37717) ci: add `zizmor` to `lint-actions` (go-gitea#37720) chore(doctor): remove four obsolete doctor check implementations (go-gitea#37728) chore(renovate): enable dockerfile manager (go-gitea#37719) ... # Conflicts: # modules/globallock/locker_test.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Using the standard OpenID Connect OAuth2 provider type doesn't work well for AWS Cognito. Most of the functionality works absolutely fine, however the query parameter
post_logout_redirect_uriis not understood by Cognito and results in a bad experience when logging out.To combat this i've added a new
AWS Cognitoprovider which is almost identical to theOpen ID Connecttype except it overrides the query parameter tologout_uriwhich is what Cognito expects.This then results in a nice experience logging out with no errors seen - even though the logout does succeed. Why AWS thought they would deviate from the OAuth spec in this particular area is beyond me...