mirror of
https://github.com/go-gitea/gitea.git
synced 2026-03-18 06:03:09 -05:00
macOS' and iOS' Safari images stop loading and users are logged out #10675
Closed
opened 2025-11-02 09:15:09 -06:00 by GiteaMirror
·
13 comments
No Branch/Tag Specified
main
release/v1.25
release/v1.24
release/v1.23
release/v1.22
release/v1.21
release/v1.20
release/v1.19
release/v1.18
release/v1.17
release/v1.16
release/v1.15
release/v1.14
release/v1.13
release/v1.12
release/v1.11
release/v1.10
release/v1.9
release/v1.8
v1.25.3
v1.25.2
v1.25.1
v1.25.0
v1.24.7
v1.25.0-rc0
v1.26.0-dev
v1.24.6
v1.24.5
v1.24.4
v1.24.3
v1.24.2
v1.24.1
v1.24.0
v1.23.8
v1.24.0-rc0
v1.25.0-dev
v1.23.7
v1.23.6
v1.23.5
v1.23.4
v1.23.3
v1.23.2
v1.23.1
v1.23.0
v1.23.0-rc0
v1.24.0-dev
v1.22.6
v1.22.5
v1.22.4
v1.22.3
v1.22.2
v1.22.1
v1.22.0
v1.23.0-dev
v1.22.0-rc1
v1.21.11
v1.22.0-rc0
v1.21.10
v1.21.9
v1.21.8
v1.21.7
v1.21.6
v1.21.5
v1.21.4
v1.21.3
v1.21.2
v1.20.6
v1.21.1
v1.21.0
v1.21.0-rc2
v1.21.0-rc1
v1.20.5
v1.22.0-dev
v1.21.0-rc0
v1.20.4
v1.20.3
v1.20.2
v1.20.1
v1.20.0
v1.19.4
v1.21.0-dev
v1.20.0-rc2
v1.20.0-rc1
v1.20.0-rc0
v1.19.3
v1.19.2
v1.19.1
v1.19.0
v1.19.0-rc1
v1.20.0-dev
v1.19.0-rc0
v1.18.5
v1.18.4
v1.18.3
v1.18.2
v1.18.1
v1.18.0
v1.17.4
v1.18.0-rc1
v1.19.0-dev
v1.18.0-rc0
v1.17.3
v1.17.2
v1.17.1
v1.17.0
v1.17.0-rc2
v1.16.9
v1.17.0-rc1
v1.18.0-dev
v1.16.8
v1.16.7
v1.16.6
v1.16.5
v1.16.4
v1.16.3
v1.16.2
v1.16.1
v1.16.0
v1.15.11
v1.17.0-dev
v1.16.0-rc1
v1.15.10
v1.15.9
v1.15.8
v1.15.7
v1.15.6
v1.15.5
v1.15.4
v1.15.3
v1.15.2
v1.15.1
v1.14.7
v1.15.0
v1.15.0-rc3
v1.14.6
v1.15.0-rc2
v1.14.5
v1.16.0-dev
v1.15.0-rc1
v1.14.4
v1.14.3
v1.14.2
v1.14.1
v1.14.0
v1.13.7
v1.14.0-rc2
v1.13.6
v1.13.5
v1.14.0-rc1
v1.15.0-dev
v1.13.4
v1.13.3
v1.13.2
v1.13.1
v1.13.0
v1.12.6
v1.13.0-rc2
v1.14.0-dev
v1.13.0-rc1
v1.12.5
v1.12.4
v1.12.3
v1.12.2
v1.12.1
v1.11.8
v1.12.0
v1.11.7
v1.12.0-rc2
v1.11.6
v1.12.0-rc1
v1.13.0-dev
v1.11.5
v1.11.4
v1.11.3
v1.10.6
v1.12.0-dev
v1.11.2
v1.10.5
v1.11.1
v1.10.4
v1.11.0
v1.11.0-rc2
v1.10.3
v1.11.0-rc1
v1.10.2
v1.10.1
v1.10.0
v1.9.6
v1.9.5
v1.10.0-rc2
v1.11.0-dev
v1.10.0-rc1
v1.9.4
v1.9.3
v1.9.2
v1.9.1
v1.9.0
v1.9.0-rc2
v1.10.0-dev
v1.9.0-rc1
v1.8.3
v1.8.2
v1.8.1
v1.8.0
v1.8.0-rc3
v1.7.6
v1.8.0-rc2
v1.7.5
v1.8.0-rc1
v1.9.0-dev
v1.7.4
v1.7.3
v1.7.2
v1.7.1
v1.7.0
v1.7.0-rc3
v1.6.4
v1.7.0-rc2
v1.6.3
v1.7.0-rc1
v1.7.0-dev
v1.6.2
v1.6.1
v1.6.0
v1.6.0-rc2
v1.5.3
v1.6.0-rc1
v1.6.0-dev
v1.5.2
v1.5.1
v1.5.0
v1.5.0-rc2
v1.5.0-rc1
v1.5.0-dev
v1.4.3
v1.4.2
v1.4.1
v1.4.0
v1.4.0-rc3
v1.4.0-rc2
v1.3.3
v1.4.0-rc1
v1.3.2
v1.3.1
v1.3.0
v1.3.0-rc2
v1.3.0-rc1
v1.2.3
v1.2.2
v1.2.1
v1.2.0
v1.2.0-rc3
v1.2.0-rc2
v1.1.4
v1.2.0-rc1
v1.1.3
v1.1.2
v1.1.1
v1.1.0
v1.0.2
v1.0.1
v1.0.0
v0.9.99
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
Mirrored from GitHub Pull Request
No Label
type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/gitea#10675
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @saegl5 on GitHub (Apr 17, 2023).
Description
Ever since Gitea Version 1.19.0, I have frequently encountered an issue with images: They stop loading, and then users are immediately logged/"kicked" out. Error code 404: "The page you are trying to reach either does not exist or you are not authorized to view it."
Clearing web browser history temporarily fixes the issue, for perhaps one minute.
This issue only occurs in Safari (desktop and mobile), neither Chrome, nor Firefox, nor DuckDuckGo.
Also, this issue only occurs in my Gitea instance, no other websites.Other observations: The file type doesn't matter (e.g., JPEG and GIF). I also attempted disabling the development menu, using a different MacBook, using safe mode, emptying Safari's caches, using the private window, using a different account (e.g., admin and dummy user), disabling Private Relay, disabling plug-ins, disabling privacy features (e.g., preventing cross-site tracking), changing the DNS to CloudFlare's, restarting my internet router, trying Safari Technology Preview, removing content blockers, and disabling iCloud's Safari sync.
I tried to reproduce the bug on the Gitea demo site, but the site won't allow me to even log in. Error code 500.(Can log in, now.)Might the way in which Gitea interacts with Safari, in regards to cookie behavior, have changed? Perhaps?
Debug log:
Gitea Version
1.19.1
Can you reproduce the bug on the Gitea demo site?
No
Screenshots
Example of image not loading:

Git Version
2.40.0
Operating System
Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-1031-gcp x86_64)
How are you running Gitea?
I run Gitea in a Google Cloud instance, and the Gitea package is installed using instructions from https://gitlab.com/packaging/gitea/
Database
SQLite
@wxiaoguang commented on GitHub (Apr 18, 2023):
I haven't fully understand your problem.
Do you mean that: if a user visits an image URL, then the user gets signed-out?
I do not think it is related.
app.ini, especiallyCOOKIErelated settings?Which page? I just tried, I can login try.gitea.io.
@lunny commented on GitHub (Apr 18, 2023):
I can visit it with no problem. macOS both firefox and safari.
@saegl5 commented on GitHub (Apr 24, 2023):
@wxiaoguang
I will check your docsyeah, none, but I did try addingLOGIN_REMEMBER_DAYS = 7and still encountered my issue)@wxiaoguang and @lunny
try.gitea.io works for me now, thanks
I don't encounter the issue in itCORRECTION: I do encounter the issue@wxiaoguang commented on GitHub (Apr 24, 2023):
What's the session related config in your
app.ini?Since you can't reproduce the problem on try.gitea.io, I suspect that this problem is related to your server-side session storage.
If you have no idea about how to continue debugging, a clear & minimal reproducible sample should help, eg: you could try to setup a small and clear instance, to try whether it has the same problem. If yes, report the details here then maintainers could help to reproduce and debug. If the new instance doesn't have the problem, then try to find what's the difference between it and your production instance, by fine-tuning the config options step by step.
@saegl5 commented on GitHub (Apr 24, 2023):
@wxiaoguang
app.ini:
@wxiaoguang commented on GitHub (Apr 24, 2023):
No idea from my side (it doesn't look like a Gitea's problem at the moment)
Could you try to setup a clear & minimal instance to see whether the problem would occur?
@saegl5 commented on GitHub (Apr 24, 2023):
@wxiaoguang thank you for your input and for following up
I feel odd—a bit embarrassed too—to find that the issue went way after checking "Remember This Device" before logging in
although checking that option seems logical to work, since I never had to check that option until recently, then checking that options seems to be a sort of workaround
tonight, I'll try to setup a small and clear instance, as you suggested
it could be a server-side issue, yeah
@saegl5 commented on GitHub (Apr 25, 2023):
@wxiaoguang okay, small and clear instance:
http://34.82.68.62:3000username: admin-testingpassword: 123456(my only change was to make user visibility private)closed this instance, used try.gitea.io instance (see below)
> There is nothing private or confidential in this instance...Issue occurs here too.
Just give it time; open other tabs; click around Gitea (dashboard, dashboard repository links, open dashboard in new tab, etc.)
Eventually, I start to frequently see my issue.
Come to think, if I keep user visibility public, then the images might still show but I may still be logged out. I want user visibility to be private, though.
Again, yes, it could be server-side.Inow seehave seen the issue in try.gitea.iohttps://try.gitea.io/saegl5/myprojects-testingusername: saegl5password: 123456(user visibility private)closed this instance, too
anyways, for now I am reminding myself to check "Remember This Device" before logging in
I would assume that, even with the box unchecked, that users would stay authenticated for 7 days (well, at least longer than what I am getting)
@wxiaoguang commented on GitHub (Apr 25, 2023):
OK, I know the problem now. It's related to Safari & Gitea's session management.
The key point is that "two tabs", then the previous tab's cookie session changed:need more clues@wxiaoguang commented on GitHub (Apr 25, 2023):
OK, I 99% understand the problem now. It's highly likely a Safari bug.
At the beginning, Safari sends Cookie with Avatar requests.
But after a few minutes, Safari only sends Cookie with page request, but doesn't send Cookies with Avatar request.
Then , the avatar request can't see a session cookie, then the handler (middleware) allocates a new session ID, then this cookie is applied to the whole site, then you are in a non-signed-in session.
At the beginning, Safari sends cookies.
After a while, the avatar request doesn't have cookies.
@wxiaoguang commented on GitHub (Apr 25, 2023):
According to my test, disabling this option could fix Safari's buggy behavior (actually, Google result shows that a lot of users are affected by similar buggy behavior)
Screenshot:
@wxiaoguang commented on GitHub (Apr 25, 2023):
I think this problem could be fixed by
https://github.com/go-gitea/gitea/pull/24330/files#diff-fa07e296d614e796de67f7ae9268a0660b89c09b6e5f6373b4ca7bf76a20dec7R467-R475
@saegl5 commented on GitHub (Apr 26, 2023):
@wxiaoguang wow! great work!
kindly note, however, that—as also noted above—disabling preventing cross-site tracking didn't work for me
however, I'll retry...yeah, no differenceglancing at commit808acb51c6> routers/web/web.go diff...okay, yeah, #24330 could work:
looks like the handler won't be used, meaning no new cookie if the avatar request can't see onenever mind, I see what you did in the linked diff abovethis all seems to be making sense to me now
thank you, again