Unauthenticated request to company's projects board shows 404 instead of login page #11172

New Issue

GiteaMirror · 2025-11-02T09:29:42-06:00

GiteaMirror commented

2025-11-02 09:29:42 -06:00

Originally created by @LukeOwlclaw on GitHub (Jul 6, 2023).

Description

For private instances of Gitea, ie. where https://GITEA/explore/repos redirects to the login page rather than allowing users to display any content anonymously, I expect all unauthenticated requests to be redirected to the login page.

This for example works fine for following URLs:

But when try to access the projects URL https://GITEA/MyCompany/-/projects I'll see a 404 error page.

I am aware that that page reads "The page you are trying to reach either does not exist or you are not authorized to view it." and that you could argue that it is correct, but given that the other URLs behave differently, this behaviour is inconsistent and should thus be considered a bug.

BTW, this problem cannot be reproduced via https://try.gitea.io/ since it allows anonymous access.

Gitea Version

1.19.3

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

downloaded version

Database

None

Originally created by @LukeOwlclaw on GitHub (Jul 6, 2023). ### Description For private instances of Gitea, ie. where https://GITEA/explore/repos redirects to the login page rather than allowing users to display any content anonymously, I expect all unauthenticated requests to be redirected to the login page. This for example works fine for following URLs: ![image](https://github.com/go-gitea/gitea/assets/2737900/96ae9731-302f-4d7f-a73b-9ac56c7f9a30) 1. https://GITEA/MyCompany 2. https://GITEA/org/MyCompany/members 3. https://GITEA/org/MyCompany/teams But when try to access the projects URL https://GITEA/MyCompany/-/projects I'll see a 404 error page. I am aware that that page reads "The page you are trying to reach either does not exist or you are not authorized to view it." and that you could argue that it is correct, but given that the other URLs behave differently, this behaviour is inconsistent and should thus be considered a bug. BTW, this problem cannot be reproduced via https://try.gitea.io/ since it allows anonymous access. ### Gitea Version 1.19.3 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? downloaded version ### Database None

GiteaMirror added the type/bug label 2025-11-02 09:29:42 -06:00

GiteaMirror closed this issue

2025-11-02 09:29:42 -06:00

GiteaMirror commented

2025-11-02 09:29:43 -06:00

@dsseng commented on GitHub (Jul 6, 2023):

It might be an expected behavior to prevent probing for names present. If it redirected access to private repository, it'd be possible to determine if a private repository does exist or not.

@dsseng commented on GitHub (Jul 6, 2023): It might be an expected behavior to prevent probing for names present. If it redirected access to private repository, it'd be possible to determine if a private repository does exist or not.

GiteaMirror commented

2025-11-02 09:29:43 -06:00

@LukeOwlclaw commented on GitHub (Jul 18, 2023):

@sh7dm No, I am not talking about customizable "names". For those (e.g. https://GITEA/MyCompany/DoesNotExist) any request first redirects to the login page, and after logging in to the 404 page. I am talking here only about URL https://gitea/MyCompany/-/projects which behaves differently. And this is the only URL I found which behaves like that.

@LukeOwlclaw commented on GitHub (Jul 18, 2023): @sh7dm No, I am not talking about customizable "names". For those (e.g. https://GITEA/MyCompany/DoesNotExist) any request first redirects to the login page, and after logging in to the 404 page. I am talking here only about URL https://gitea/MyCompany/-/projects which behaves differently. And this is the only URL I found which behaves like that.

GiteaMirror commented

2025-11-02 09:29:44 -06:00

@lafriks commented on GitHub (Jul 20, 2023):

Yes this looks like a bug, for private instances all pages should redirect to login

@lafriks commented on GitHub (Jul 20, 2023): Yes this looks like a bug, for private instances all pages should redirect to login

GiteaMirror commented

2025-11-02 09:29:44 -06:00

@LukeOwlclaw commented on GitHub (Jul 27, 2023):

Fixed with version 1.20.0

@LukeOwlclaw commented on GitHub (Jul 27, 2023): Fixed with version 1.20.0

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11172