[feat] introduce rawgit registry, cross origin resource sharing repo/raw/branch/main/file #13962

New Issue

GiteaMirror · 2025-11-02T10:58:29-06:00

GiteaMirror commented

2025-11-02 10:58:29 -06:00

Originally created by @loynoir on GitHub (Jan 11, 2025).

Description

BUG

repository.ACCESS_CONTROL_ALLOW_ORIGIN is not working

reproduce

Gitea access-control-allow-origin defaults to disabled.

$ (curl -v -H 'Origin: https://example.com' https://${GITEA}/api/v1/version > /dev/null) |& grep access-control-allow-origin
(empty)

According to https://docs.gitea.com/administration/config-cheat-sheet

With docker compose env config

      GITEA__cors__ENABLED: true
      GITEA__cors__ALLOW_DOMAIN: "*"
      GITEA__repository__ACCESS_CONTROL_ALLOW_ORIGIN: "*"

Manually confirm app.ini contains everything below

[repository]
ACCESS_CONTROL_ALLOW_ORIGIN = *

[cors]
ALLOW_DOMAIN = *
ENABLED = true

Gitea access-control-allow-origin now working within gitea api.

$ (curl -v -H 'Origin: https://example.com' https://${GITEA}/api/v1/version > /dev/null) |& grep access-control-allow-origin
< access-control-allow-origin: *

Until now, things are all expected.

actual

Gitea access-control-allow-origin not working within gitea repository.

$ (curl -v -H 'Origin: https://example.com' https://${GITEA}/${OWNER}/${REPO}/raw/branch/main/package.json > /dev/null) |& grep access-control-allow-origin
(empty)

expected

Gitea access-control-allow-origin working within gitea repository.

$ (curl -v -H 'Origin: https://example.com' https://${GITEA}/${OWNER}/${REPO}/raw/branch/main/package.json > /dev/null) |& grep access-control-allow-origin
< access-control-allow-origin: *

Gitea Version

Powered by Gitea Version: 1.23.1

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

docker gitea 1.23.1

Database

None

Originally created by @loynoir on GitHub (Jan 11, 2025). ### Description ### BUG `repository.ACCESS_CONTROL_ALLOW_ORIGIN` is not working ### reproduce Gitea `access-control-allow-origin` defaults to disabled. ```sh $ (curl -v -H 'Origin: https://example.com' https://${GITEA}/api/v1/version > /dev/null) |& grep access-control-allow-origin (empty) ``` According to https://docs.gitea.com/administration/config-cheat-sheet With docker compose env config ```yml GITEA__cors__ENABLED: true GITEA__cors__ALLOW_DOMAIN: "*" GITEA__repository__ACCESS_CONTROL_ALLOW_ORIGIN: "*" ``` Manually confirm `app.ini` contains everything below ```ini [repository] ACCESS_CONTROL_ALLOW_ORIGIN = * [cors] ALLOW_DOMAIN = * ENABLED = true ``` Gitea `access-control-allow-origin` now working within gitea api. ```sh $ (curl -v -H 'Origin: https://example.com' https://${GITEA}/api/v1/version > /dev/null) |& grep access-control-allow-origin < access-control-allow-origin: * ``` Until now, things are all expected. ### actual Gitea `access-control-allow-origin` not working within gitea repository. ```sh $ (curl -v -H 'Origin: https://example.com' https://${GITEA}/${OWNER}/${REPO}/raw/branch/main/package.json > /dev/null) |& grep access-control-allow-origin (empty) ``` ### expected Gitea `access-control-allow-origin` working within gitea repository. ```sh $ (curl -v -H 'Origin: https://example.com' https://${GITEA}/${OWNER}/${REPO}/raw/branch/main/package.json > /dev/null) |& grep access-control-allow-origin < access-control-allow-origin: * ``` ### Gitea Version Powered by Gitea Version: 1.23.1 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? docker gitea 1.23.1 ### Database None

GiteaMirror added the type/bug label 2025-11-02 10:58:29 -06:00

GiteaMirror commented

2025-11-02 10:58:30 -06:00

@wxiaoguang commented on GitHub (Jan 11, 2025):

It was only designed for these paths:

Support CORS headers to git smart http protocol (#5719)

@wxiaoguang commented on GitHub (Jan 11, 2025): It was only designed for these paths: * Support CORS headers to git smart http protocol (#5719) <details> ![image](https://github.com/user-attachments/assets/2eca81c7-d3c2-40d7-90e7-9ef7cc8ad0ce) </details>

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13962

[feat] introduce rawgit registry, cross origin resource sharing repo/raw/branch/main/file #13962

Description

BUG

reproduce

actual

expected

Gitea Version

Can you reproduce the bug on the Gitea demo site?

Log Gist

Screenshots

Git Version

Operating System

How are you running Gitea?

Database

[feat] introduce `rawgit` registry, cross origin resource sharing `repo/raw/branch/main/file` #13962