Sign in not possible behind tinyproxy with sub-path #13081

@LauKr commented on GitHub (May 31, 2024):

Sadly GitHub doesn't let me upload a file with .path extension. I changed it to .txt instead.
diff.txt

This diff shows the revert plus two comments that allowed us to login again.

@LauKr commented on GitHub (May 31, 2024): Sadly GitHub doesn't let me upload a file with .path extension. I changed it to .txt instead. [diff.txt](https://github.com/user-attachments/files/15516402/diff.txt) This diff shows the revert plus two comments that allowed us to login again.

GiteaMirror commented

@LauKr commented on GitHub (May 31, 2024):

No, deleting cookies, using a private window etc. did not work. We already tried this first, due to #29757 and #29881.

The POST request for login has the following cookies set:

Set-Cookie: yummy_magical_cookie=/git-staging/; path=/
Cookie: i_like_gitea=XXX; _csrf=XXX; yummy_magical_cookie=/git-staging/

@LauKr commented on GitHub (May 31, 2024): 1. No, deleting cookies, using a private window etc. did not work. We already tried this first, due to #29757 and #29881. 2. The POST request for login has the following cookies set: ``` Set-Cookie: yummy_magical_cookie=/git-staging/; path=/ Cookie: i_like_gitea=XXX; _csrf=XXX; yummy_magical_cookie=/git-staging/ ```

GiteaMirror commented

@bohde commented on GitHub (May 31, 2024):

I worked with @jtran on this change for bug we were seeing in a deployment that is also behind a reverse proxy (nginx in our case) with a subpath of /app_path/. The set-cookie headers as a result of POST /app_path/user/login look like the following in my Firefox network tab:

set-cookie i_like_gitea=; Path=/app_path/; Max-Age=0; HttpOnly; Secure; SameSite=Lax
set-cookie i_like_gitea=<redacted>; Path=/app_path; HttpOnly; Secure; SameSite=Lax
set-cookie lang=; Path=/app_path/; Max-Age=0; HttpOnly; Secure; SameSite=Lax
set-cookie_csrf=; Path=/app_path; Max-Age=0; HttpOnly; Secure; SameSite=Lax
set-cookie redirect_to=; Path=/app_path; Max-Age=0; HttpOnly; Secure; SameSite=Lax
set-cookie redirect_to=; Path=/app_path/; Max-Age=0; HttpOnly; Secure; SameSite=Lax

@LauKr based on my reading of your config, it appears like your cookies should set Path=/git-staging, but it appears that's not happening from the Set-Cookie header your posted.

@bohde commented on GitHub (May 31, 2024): I worked with @jtran on this change for bug we were seeing in a deployment that is also behind a reverse proxy (nginx in our case) with a subpath of `/app_path/`. The `set-cookie` headers as a result of `POST /app_path/user/login` look like the following in my Firefox network tab: ``` set-cookie i_like_gitea=; Path=/app_path/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie i_like_gitea=<redacted>; Path=/app_path; HttpOnly; Secure; SameSite=Lax set-cookie lang=; Path=/app_path/; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie_csrf=; Path=/app_path; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie redirect_to=; Path=/app_path; Max-Age=0; HttpOnly; Secure; SameSite=Lax set-cookie redirect_to=; Path=/app_path/; Max-Age=0; HttpOnly; Secure; SameSite=Lax ``` @LauKr based on my reading of your config, it appears like your cookies should set `Path=/git-staging`, but it appears that's not happening from the `Set-Cookie` header your posted.

GiteaMirror commented

@wxiaoguang commented on GitHub (Jun 1, 2024):

@LauKr it doesn't seem right in your reverse proxy config.

Did you see any Set-Cookie for i_like_gitea? Which path is it on? It is directly related to Gitea login.

And, did you set any ReversePath or related config for your reverse proxy? I think they should be removed. UPDATE: maybe it should set ReverseMagic No, see below.

Since you are using tinyproxy, could you prepare a reproducible setup with detailed steps ? If you could provide a docker compose to reproduce, then I could try to debug it on my machine.

@wxiaoguang commented on GitHub (Jun 1, 2024): @LauKr it doesn't seem right in your reverse proxy config. Did you see any `Set-Cookie` for `i_like_gitea`? Which path is it on? It is directly related to Gitea login. And, did you set any `ReversePath` or related config for your reverse proxy? I think they should be removed. UPDATE: maybe it should set `ReverseMagic No`, see below. ---- Since you are using tinyproxy, could you prepare a reproducible setup with detailed steps ? If you could provide a docker compose to reproduce, then I could try to debug it on my machine.

GiteaMirror commented

@wxiaoguang commented on GitHub (Jun 1, 2024):

And one more thing, It seems that tinyproxy does some trick (black magic?) on the "cookie path". https://github.com/search?q=repo%3Atinyproxy%2Ftinyproxy%20REVERSE_COOKIE&type=code

I do not feel it is quite right. If there is a chance, I would recommend to try to use some modern and standard reverse proxies.

ps: I guess setting ReverseMagic No should resolve the problem, according to the code in tinyproxy:

@wxiaoguang commented on GitHub (Jun 1, 2024): And one more thing, It seems that tinyproxy does some trick (black magic?) on the "cookie path". https://github.com/search?q=repo%3Atinyproxy%2Ftinyproxy%20REVERSE_COOKIE&type=code I do not feel it is quite right. If there is a chance, I would recommend to try to use some modern and standard reverse proxies. ps: I guess setting `ReverseMagic No` should resolve the problem, according to the code in tinyproxy: <details> ![image](https://github.com/go-gitea/gitea/assets/2114189/a156b5c0-e26e-43be-a9bb-4b2413e0957f) </details>

GiteaMirror commented

@wxiaoguang commented on GitHub (Jun 4, 2024):

Any update?

@wxiaoguang commented on GitHub (Jun 4, 2024): Any update?

GiteaMirror commented

@LauKr commented on GitHub (Jun 4, 2024):

Any update?

Sorry, I need some time for the reproducible build.

Changing ReverseMagic to No sadly didn't resolve the issue. I'll try debugging where the cookie went as soon as I find the time.

@LauKr commented on GitHub (Jun 4, 2024): > Any update? Sorry, I need some time for the reproducible build. Changing `ReverseMagic` to No sadly didn't resolve the issue. I'll try debugging where the cookie went as soon as I find the time.

GiteaMirror commented

2025-11-02 10:29:45 -06:00

@LauKr commented on GitHub (Jun 9, 2024):

Hi,
sorry for the delay. I wrote a Dockerfile to reproduce the issue. Necessary files are attached:
setup_for_debugging.tar.gz

Building and running was tested using Podman, but should work with Docker as well:

podman build -t gitea_proxy_testing --file Dockerfile
podman run --rm -it --publish 8888:8888 gitea_proxy_testing:latest

The Dockerfile creates a container with Gitea and tinyproxy. The tinyproxy is accessible via port 8888.
Accessing Gitea via 127.0.0.1:8888/git-staging/ was successful, but login was not possible, as described in the issue.

@LauKr commented on GitHub (Jun 9, 2024): Hi, sorry for the delay. I wrote a Dockerfile to reproduce the issue. Necessary files are attached: [setup_for_debugging.tar.gz](https://github.com/user-attachments/files/15753539/setup_for_debugging.tar.gz) Building and running was tested using Podman, but should work with Docker as well: ```bash podman build -t gitea_proxy_testing --file Dockerfile podman run --rm -it --publish 8888:8888 gitea_proxy_testing:latest ``` The Dockerfile creates a container with Gitea and tinyproxy. The tinyproxy is accessible via port 8888. Accessing Gitea via 127.0.0.1:8888/git-staging/ was successful, but login was not possible, as described in the issue.

GiteaMirror commented

@wxiaoguang commented on GitHub (Jun 10, 2024):

I guess the problem is caused by that the new cookie is correctly removed by the "deleting legacy code". So I think we could try to flip the order: first delete the legacy cookie, then set new cookie, then the new cookie won't be deleted.

-> Delete legacy cookie before setting new cookie #31306

@wxiaoguang commented on GitHub (Jun 10, 2024): I guess the problem is caused by that the new cookie is correctly removed by the "deleting legacy code". So I think we could try to flip the order: first delete the legacy cookie, then set new cookie, then the new cookie won't be deleted. -> Delete legacy cookie before setting new cookie #31306

GiteaMirror commented

2025-11-02 10:29:45 -06:00

@wxiaoguang commented on GitHub (Jun 11, 2024):

Wait for backport to 1.22

@wxiaoguang commented on GitHub (Jun 11, 2024): Wait for backport to 1.22

GiteaMirror commented

2025-11-02 10:29:45 -06:00

@LauKr commented on GitHub (Jun 11, 2024):

When trying use a custom build on commit 5342a61124, the problem was not fixed in the provided container setup.
I'll have a look at the proxy again, just in case.

@LauKr commented on GitHub (Jun 11, 2024): When trying use a custom build on commit 5342a61124bf2d4fbe4c1d560b13866198149ac9, the problem was not fixed in the provided container setup. I'll have a look at the proxy again, just in case.

GiteaMirror commented

2025-11-02 10:29:46 -06:00

@lunny commented on GitHub (Jun 11, 2024):

Backport merged, wait for @LauKr 's confirmation and feedback.

@lunny commented on GitHub (Jun 11, 2024): Backport merged, wait for @LauKr 's confirmation and feedback.

GiteaMirror commented

2025-11-02 10:29:46 -06:00

@wxiaoguang commented on GitHub (Jun 11, 2024):

Backport merged, wait for @LauKr 's confirmation and feedback.

It's said that the "fix" doesn't work.

@wxiaoguang commented on GitHub (Jun 11, 2024): > Backport merged, wait for @LauKr 's confirmation and feedback. It's said that the "fix" doesn't work.

GiteaMirror commented

2025-11-02 10:29:46 -06:00

@wxiaoguang commented on GitHub (Jun 11, 2024):

I think it is a bug in tinyproxy. By using tcpdump, I can see:

Gitea tells tinyproxy:

HTTP/1.1 303 See Other
Cache-Control: max-age=0, private, must-revalidate, no-transform
Content-Type: text/plain; charset=utf-8
Location: /git-staging/
Set-Cookie: _csrf=en3AFom-bfjvNKBwckDCoPm17uQ6MTcxODA5OTk4NzE4NzcxMzAwMA; Path=/git-staging; Max-Age=86400; HttpOnly; SameSite=Lax
Set-Cookie: i_like_gitea=; Path=/git-staging/; Max-Age=0; HttpOnly; SameSite=Lax
Set-Cookie: i_like_gitea=fb422c79cf11bd1f; Path=/git-staging; HttpOnly; SameSite=Lax
Set-Cookie: lang=; Path=/git-staging/; Max-Age=0; HttpOnly; SameSite=Lax
Set-Cookie: lang=en-US; Path=/git-staging; HttpOnly; SameSite=Lax
Set-Cookie: _csrf=; Path=/git-staging; Max-Age=0; HttpOnly; SameSite=Lax
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-Gitea-Debug: RUN_MODE=dev
Date: Tue, 11 Jun 2024 09:59:47 GMT
Content-Length: 0
Connection: close

Tinyproxy tells browsers

HTTP/1.1 303 See Other
Via: 1.1 tinyproxy (tinyproxy/1.11.2)
Cache-Control: max-age=0, private, must-revalidate, no-transform
Content-Type: text/plain; charset=utf-8
Location: /git-staging/
Set-Cookie: _csrf=en3AFom-bfjvNKBwckDCoPm17uQ6MTcxODA5OTk4NzE4NzcxMzAwMA; Path=/git-staging; Max-Age=86400; HttpOnly; SameSite=Lax

!!!!!!!! HERE, all other cookies are lost !!!!!!!!!!

Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-Gitea-Debug: RUN_MODE=dev
Date: Tue, 11 Jun 2024 09:59:47 GMT
Content-Length: 0

Tinyproxy loses most cookies for browsers.

@wxiaoguang commented on GitHub (Jun 11, 2024): I think it is a bug in tinyproxy. By using `tcpdump`, I can see: #### Gitea tells tinyproxy: ``` HTTP/1.1 303 See Other Cache-Control: max-age=0, private, must-revalidate, no-transform Content-Type: text/plain; charset=utf-8 Location: /git-staging/ Set-Cookie: _csrf=en3AFom-bfjvNKBwckDCoPm17uQ6MTcxODA5OTk4NzE4NzcxMzAwMA; Path=/git-staging; Max-Age=86400; HttpOnly; SameSite=Lax Set-Cookie: i_like_gitea=; Path=/git-staging/; Max-Age=0; HttpOnly; SameSite=Lax Set-Cookie: i_like_gitea=fb422c79cf11bd1f; Path=/git-staging; HttpOnly; SameSite=Lax Set-Cookie: lang=; Path=/git-staging/; Max-Age=0; HttpOnly; SameSite=Lax Set-Cookie: lang=en-US; Path=/git-staging; HttpOnly; SameSite=Lax Set-Cookie: _csrf=; Path=/git-staging; Max-Age=0; HttpOnly; SameSite=Lax Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-Gitea-Debug: RUN_MODE=dev Date: Tue, 11 Jun 2024 09:59:47 GMT Content-Length: 0 Connection: close ``` #### Tinyproxy tells browsers ``` HTTP/1.1 303 See Other Via: 1.1 tinyproxy (tinyproxy/1.11.2) Cache-Control: max-age=0, private, must-revalidate, no-transform Content-Type: text/plain; charset=utf-8 Location: /git-staging/ Set-Cookie: _csrf=en3AFom-bfjvNKBwckDCoPm17uQ6MTcxODA5OTk4NzE4NzcxMzAwMA; Path=/git-staging; Max-Age=86400; HttpOnly; SameSite=Lax !!!!!!!! HERE, all other cookies are lost !!!!!!!!!! Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN X-Gitea-Debug: RUN_MODE=dev Date: Tue, 11 Jun 2024 09:59:47 GMT Content-Length: 0 ``` Tinyproxy loses most cookies for browsers.

GiteaMirror commented

@wxiaoguang commented on GitHub (Jun 11, 2024):

I would suggest to use a professional reverse proxy like nginx, which is also small enough and I guess it won't cost more resources than tinyproxy.

@wxiaoguang commented on GitHub (Jun 11, 2024): I would suggest to use a professional reverse proxy like nginx, which is also small enough and I guess it won't cost more resources than tinyproxy.

GiteaMirror commented

@LauKr commented on GitHub (Jun 11, 2024):

Thanks for the effort.
We will try to debug tinyproxy and create a separate issue there. Hopefully observing tinyproxy will show a clear reason why it cannot handle the changes mode by the mentioned commit.
Testing with NGINX looks promising, however we will have to consider the feature set etc. first, before switching.

@LauKr commented on GitHub (Jun 11, 2024): Thanks for the effort. We will try to debug tinyproxy and create a separate issue there. Hopefully observing tinyproxy will show a clear reason why it cannot handle the changes mode by the mentioned commit. Testing with NGINX looks promising, however we will have to consider the feature set etc. first, before switching.

GiteaMirror commented

@LauKr commented on GitHub (Jun 11, 2024):

For reference, if anyone happens to have the same issue:
https://github.com/tinyproxy/tinyproxy/issues/403 describes a relevant issue:

All but the first of Set-Cookie headers in an HTTP response will be silently dropped by tinyproxy

The corresponding PR is still open: https://github.com/tinyproxy/tinyproxy/pull/435

However, we were able to confirm the fix by building a custom version of tinyproxy. As we use Debian, the Debian repository with corresponding release is used (https://salsa.debian.org/debian/tinyproxy/-/tags/debian%2F1.11.1-2) and the commits are applied on top.

Using this custom version of tinyproxy a login into Gitea is possible.

@wxiaoguang from my side this issue can be closed, as this is evidently no Gitea issue.

@LauKr commented on GitHub (Jun 11, 2024): For reference, if anyone happens to have the same issue: https://github.com/tinyproxy/tinyproxy/issues/403 describes a relevant issue: > All but the first of Set-Cookie headers in an HTTP response will be silently dropped by `tinyproxy` The corresponding PR is still open: https://github.com/tinyproxy/tinyproxy/pull/435 However, we were able to confirm the fix by building a custom version of `tinyproxy`. As we use Debian, the Debian repository with corresponding release is used (https://salsa.debian.org/debian/tinyproxy/-/tags/debian%2F1.11.1-2) and the commits are applied on top. Using this custom version of `tinyproxy` a **login into Gitea is possible**. @wxiaoguang from my side this issue can be closed, as this is evidently no Gitea issue.

GiteaMirror commented