Update docs for DISABLE_QUERY_AUTH_TOKEN (#28485) (#28488)

Backport #28485 by @kdumontnu As described [here](#28390 (comment)). Co-authored-by: Kyle D <[email protected]>
go-gitea · Dec 16, 2023 · 2c2e008 · 2c2e008
1 parent 6cbb6f3
commit 2c2e008
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/docs/content/administration/config-cheat-sheet.en-us.md b/docs/content/administration/config-cheat-sheet.en-us.md
@@ -571,6 +571,7 @@ And the following unique queues:
   - off - do not check password complexity
 - `PASSWORD_CHECK_PWN`: **false**: Check [HaveIBeenPwned](https://haveibeenpwned.com/Passwords) to see if a password has been exposed.
 - `SUCCESSFUL_TOKENS_CACHE_SIZE`: **20**: Cache successful token hashes. API tokens are stored in the DB as pbkdf2 hashes however, this means that there is a potentially significant hashing load when there are multiple API operations. This cache will store the successfully hashed tokens in a LRU cache as a balance between performance and security.
+- `DISABLE_QUERY_AUTH_TOKEN`: **false**: Reject API tokens sent in URL query string (Accept Header-based API tokens only). This setting will default to `true` in Gitea 1.23 and be deprecated in Gitea 1.24.
 
 ## Camo (`camo`)