Error 403 when using dot in file names #11595

New Issue

GiteaMirror · 2025-11-02T09:42:03-06:00

GiteaMirror commented

2025-11-02 09:42:03 -06:00

Originally created by @cairoapcampos on GitHub (Sep 5, 2023).

Description

When accessing files that have a dot at the beginning of the name, a 403 error is displayed.

Example: .profile, .env_file, etc.

This 403 error does not occur when I access it without using a reverse proxy, that is, using an IP and port.

Can you help me ?

Screenshots

Gitea Version

1.20.3

Can you reproduce the bug on the Gitea demo site?

Yes

Operating System

Docker Containers Linux - Image Official

Browser Version

Google Chrome 116.0.5845.140

Originally created by @cairoapcampos on GitHub (Sep 5, 2023). ### Description When accessing files that have a dot at the beginning of the name, a 403 error is displayed. Example: `.profile`, `.env_file`, etc. This 403 error does not occur when I access it without using a reverse proxy, that is, using an IP and port. Can you help me ? ### Screenshots ![erro](https://github.com/go-gitea/gitea/assets/21186839/1bb0175d-5a9d-4a0f-9f2b-e4b3c23fd673) ### Gitea Version 1.20.3 ### Can you reproduce the bug on the Gitea demo site? Yes ### Operating System Docker Containers Linux - Image Official ### Browser Version Google Chrome 116.0.5845.140

GiteaMirror added the type/question issue/needs-feedback labels 2025-11-02 09:42:03 -06:00

GiteaMirror closed this issue

2025-11-02 09:42:03 -06:00

GiteaMirror commented

2025-11-02 09:42:04 -06:00

@eeyrjmr commented on GitHub (Sep 5, 2023):

odd,
works on the try site, at least a .gitignore file

https://try.gitea.io/eeyrjmr/CommitGraphCSS/src/branch/main/.gitignore

@eeyrjmr commented on GitHub (Sep 5, 2023): odd, works on the try site, at least a .gitignore file https://try.gitea.io/eeyrjmr/CommitGraphCSS/src/branch/main/.gitignore

GiteaMirror commented

2025-11-02 09:42:04 -06:00

@techknowlogick commented on GitHub (Sep 5, 2023):

without using a reverse proxy,

There is likely a reverse proxy rule disallowing URLs with dots at the start. Which reverse proxy are you using, and could you share its relevant config?

@techknowlogick commented on GitHub (Sep 5, 2023): > without using a reverse proxy, There is likely a reverse proxy rule disallowing URLs with dots at the start. Which reverse proxy are you using, and could you share its relevant config?

GiteaMirror commented

2025-11-02 09:42:04 -06:00

@cairoapcampos commented on GitHub (Sep 5, 2023):

On the Nginx proxy I have a security.conf file. This file has a setting that blocks filenames starting with ".".
After changing these settings the problem was solved.

Before:

# security headers
add_header X-Frame-Options           "SAMEORIGIN" always;
add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
add_header Referrer-Policy           "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' https: data: blob: 'unsafe-inline' 'unsafe-eval'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

After:

# security headers
add_header X-Frame-Options           "SAMEORIGIN" always;
add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
add_header Referrer-Policy           "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' https: data: blob: 'unsafe-inline' 'unsafe-eval'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# . files
location ~ /\.(?!well-known|profile|gitignore|env_) {
    deny all;
}

Problem solved! Thank you for your help.

@cairoapcampos commented on GitHub (Sep 5, 2023): On the Nginx proxy I have a `security.conf` file. This file has a setting that blocks filenames starting with ".". After changing these settings the problem was solved. **Before:** ``` # security headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Content-Security-Policy "default-src 'self' https: data: blob: 'unsafe-inline' 'unsafe-eval'" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # . files location ~ /\.(?!well-known) { deny all; } ``` **After:** ``` # security headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Content-Security-Policy "default-src 'self' https: data: blob: 'unsafe-inline' 'unsafe-eval'" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # . files location ~ /\.(?!well-known|profile|gitignore|env_) { deny all; } ``` Problem solved! Thank you for your help.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11595