Mixed content warnings on newsfeed #1001

New Issue

GiteaMirror · 2025-11-02T03:44:49-06:00

GiteaMirror commented

2025-11-02 03:44:49 -06:00

Originally created by @davidmehren on GitHub (Aug 25, 2017).

Gitea version (or commit ref): 1.2.0+rc1
Git version: 2.11.0
Operating system: Ubuntu 17.04
Database:
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

When using the new 1.2.0 RC1, Chrome complains about mixed content on the "newsfeed" that is shown when a user is logged in.
The user profile picture on the left of each news entry is loaded using a absolute URL and HTTP:

<div class="news">
		<div class="ui left">
			<img class="ui avatar image" src="http://my.domain.net/avatars/3f01fd3bf5ae0bf66baa29afae3aadd4" alt="">
		</div>
...

1.1.2 is using relative URLs:

<div class="news">
		<div class="ui left">
			<img class="ui avatar image" src="/avatars/48b54c558b98d21bb042f4ddf2f9bf7d" alt="">
		</div>
...

Gitea is running behind a nginx reverse proxy which terminates the TLS connection to the clients.

I can not reproduce this on try.gitea.io, because that seems to be using Gravatar for profile pics, which are loaded using HTTPS.

Originally created by @davidmehren on GitHub (Aug 25, 2017). - Gitea version (or commit ref): 1.2.0+rc1 - Git version: 2.11.0 - Operating system: Ubuntu 17.04 - Database: - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [x] No - [ ] Not relevant - Log gist: ## Description When using the new 1.2.0 RC1, Chrome complains about mixed content on the "newsfeed" that is shown when a user is logged in. The user profile picture on the left of each news entry is loaded using a absolute URL and HTTP: ```html <div class="news"> <div class="ui left"> <img class="ui avatar image" src="http://my.domain.net/avatars/3f01fd3bf5ae0bf66baa29afae3aadd4" alt=""> </div> ... ``` 1.1.2 is using relative URLs: ```html <div class="news"> <div class="ui left"> <img class="ui avatar image" src="/avatars/48b54c558b98d21bb042f4ddf2f9bf7d" alt=""> </div> ... ``` Gitea is running behind a nginx reverse proxy which terminates the TLS connection to the clients. I can not reproduce this on try.gitea.io, because that seems to be using Gravatar for profile pics, which are loaded using HTTPS.

GiteaMirror added the type/question label 2025-11-02 03:44:50 -06:00

GiteaMirror closed this issue

2025-11-02 03:44:50 -06:00

GiteaMirror commented

2025-11-02 03:44:51 -06:00

@lunny commented on GitHub (Aug 26, 2017):

@Morlinest maybe you can see this one.

@lunny commented on GitHub (Aug 26, 2017): @Morlinest maybe you can see this one.

GiteaMirror commented

2025-11-02 03:44:51 -06:00

@Morlinest commented on GitHub (Aug 26, 2017):

@lunny I hope yes.

I think problem is when you use reverse proxy with Content Security Policy (CSP) protection enabled and serving content from other urls/ports. In NGINX config it looks like this: add_header Content-Security-Policy ....

@davidmehren Did you set your app url (in ini it is ROOT_URL) in gitea to https://my.domain.net?

@Morlinest commented on GitHub (Aug 26, 2017): @lunny I hope yes. I think problem is when you use reverse proxy with `Content Security Policy (CSP)` protection enabled and serving content from other urls/ports. In NGINX config it looks like this: `add_header Content-Security-Policy ...`. @davidmehren Did you set your `app url` (in ini it is `ROOT_URL`) in gitea to `https://my.domain.net`?

GiteaMirror commented

2025-11-02 03:44:51 -06:00

@davidmehren commented on GitHub (Aug 31, 2017):

Everything is fine again after I changed ROOT_URL from %(PROTOCOL)s://%(DOMAIN)s/ to https://my.domain.net.

I was first confused by this setting, because after I set PROTOCOL to https Gitea refused to start. I then realised that I need to start Gitea in HTTP mode but with an HTTPS URL (Because otherwise it expects a TLS certificate).

@Morlinest Thanks for your advice!

One last question: Why did everything work in Gitea 1.2? Was there a behaviour change in 1.3?

@davidmehren commented on GitHub (Aug 31, 2017): Everything is fine again after I changed `ROOT_URL` from `%(PROTOCOL)s://%(DOMAIN)s/` to `https://my.domain.net`. I was first confused by this setting, because after I set `PROTOCOL` to `https` Gitea refused to start. I then realised that I need to start Gitea in HTTP mode but with an HTTPS URL (Because otherwise it expects a TLS certificate). @Morlinest Thanks for your advice! One last question: Why did everything work in Gitea 1.2? Was there a behaviour change in 1.3?

GiteaMirror commented

2025-11-02 03:44:51 -06:00

@DerMolly commented on GitHub (Aug 31, 2017):

@davidmehren you mean 1.1.2 and 1.1.3, don't you?

@DerMolly commented on GitHub (Aug 31, 2017): @davidmehren you mean 1.1.2 and 1.1.3, don't you?

GiteaMirror commented

2025-11-02 03:44:52 -06:00

@Morlinest commented on GitHub (Aug 31, 2017):

@davidmehren You're welcome. I think change from relative to absolute url was done in #1779 + #1820 (new function GetActAvatar was used instead of removed ActAvatar struct value)

@Morlinest commented on GitHub (Aug 31, 2017): @davidmehren You're welcome. I think change from relative to absolute url was done in #1779 + #1820 (new function `GetActAvatar` was used instead of removed `ActAvatar` struct value)

GiteaMirror referenced this issue

2025-11-02 04:42:01 -06:00

[improve]Search issue or pr by id #2611

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#1001