Confusion as to where reverse proxy headers go in app.ini #14210

New Issue

GiteaMirror · 2025-11-02T11:06:27-06:00

GiteaMirror commented

2025-11-02 11:06:27 -06:00

Originally created by @yatesco on GitHub (Mar 2, 2025).

Description

Hi, in https://docs.gitea.com/usage/authentication#reverse-proxy it states that various settings can be overridden, for example REVERSE_PROXY_AUTHENTICATION_USER. It doesn't, however, explicitly state where they should go in app.ini. Given that the only section that is referenced is [service] I naively put them in there.

Moving

REVERSE_PROXY_AUTHENTICATION_USER = Remote-User
REVERSE_PROXY_AUTHENTICATION_EMAIL = Remote-Email

to the [security] section worked.

My question is, how am I supposed to know, as a reader, that those headers shouldn't be in the [service] section? Happy to do a PR to clarify the wording if that helps?

(This is in the context of trying to configure this for Authelia forward auth via Caddy. With the header overrides set in the [service] section, Gitea failed to "notice" the authenticated user and so required additional logging in. Moving them to the [security] section and suddenly the user could login successfully.)

Gitea Version

1.22.3

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

No response

Operating System

No response

How are you running Gitea?

natively in proxmox debian LXC

Database

None

Originally created by @yatesco on GitHub (Mar 2, 2025). ### Description Hi, in https://docs.gitea.com/usage/authentication#reverse-proxy it states that various settings can be overridden, for example `REVERSE_PROXY_AUTHENTICATION_USER`. It doesn't, however, explicitly state where they should go in `app.ini`. Given that the only section that is referenced is `[service]` I naively put them in there. Moving ``` REVERSE_PROXY_AUTHENTICATION_USER = Remote-User REVERSE_PROXY_AUTHENTICATION_EMAIL = Remote-Email ``` to the `[security]` section worked. My question is, how am I supposed to know, as a reader, that those headers shouldn't be in the `[service]` section? Happy to do a PR to clarify the wording if that helps? (This is in the context of trying to configure this for Authelia forward auth via Caddy. With the header overrides set in the `[service]` section, Gitea failed to "notice" the authenticated user and so required additional logging in. Moving them to the `[security]` section and suddenly the user could login successfully.) ### Gitea Version 1.22.3 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots <img width="784" alt="Image" src="https://github.com/user-attachments/assets/cc192352-e340-4215-be13-f9817ad0da06" /> ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? natively in proxmox debian LXC ### Database None

GiteaMirror added the issue/needs-feedback label 2025-11-02 11:06:27 -06:00

GiteaMirror closed this issue

2025-11-02 11:06:27 -06:00

GiteaMirror commented

2025-11-02 11:06:28 -06:00

@lunny commented on GitHub (Mar 2, 2025):

It should be under section service but security. I believe why it works because now they are using default values after your moving.

@lunny commented on GitHub (Mar 2, 2025): It should be under section `service` but `security`. I believe why it works because now they are using default values after your moving.

GiteaMirror commented

2025-11-02 11:06:28 -06:00

@wxiaoguang commented on GitHub (Mar 3, 2025):

See https://github.com/go-gitea/gitea/blob/main/custom/conf/app.example.ini

[service]
ENABLE_REVERSE_PROXY_AUTHENTICATION

[security]
REVERSE_PROXY_AUTHENTICATION_EMAIL
REVERSE_PROXY_AUTHENTICATION_USER

A lot of Gitea's code is crowd-contributed (open source), so some designs are very casual. Just get used to it, or contribute to make it better ......

@wxiaoguang commented on GitHub (Mar 3, 2025): See https://github.com/go-gitea/gitea/blob/main/custom/conf/app.example.ini ``` [service] ENABLE_REVERSE_PROXY_AUTHENTICATION [security] REVERSE_PROXY_AUTHENTICATION_EMAIL REVERSE_PROXY_AUTHENTICATION_USER ``` A lot of Gitea's code is crowd-contributed (open source), so some designs are very casual. Just get used to it, or contribute to make it better ......

GiteaMirror commented

2025-11-02 11:06:29 -06:00

@flixman commented on GitHub (Mar 31, 2025):

@yatesco I have come to your question looking for something else, unsuccessfully: Might you have a working setup gitea/authelia? I am getting an error in authelia an error about token_endpoint_auth_method being 'client_secret_basic', and should be client_secret_post, but if I change it to _post, then I get an error saying it should be _basic. crazy! Have you managed to make this setup work?

Edit: do not bother... it's been enough to ask the question to get it to work. Thank you!

@flixman commented on GitHub (Mar 31, 2025): @yatesco I have come to your question looking for something else, unsuccessfully: Might you have a working setup gitea/authelia? I am getting an error in authelia an error about token_endpoint_auth_method being 'client_secret_basic', and should be client_secret_post, but if I change it to _post, then I get an error saying it should be _basic. crazy! Have you managed to make this setup work? Edit: do not bother... it's been enough to ask the question to get it to work. Thank you!

GiteaMirror commented

2025-11-02 11:06:29 -06:00

@sxyandapp commented on GitHub (Apr 24, 2025):

我也刚意识到 ENABLE_REVERSE_PROXY_AUTHENTICATION 和 REVERSE_PROXY_AUTHENTICATION_EMAIL/REVERSE_PROXY_AUTHENTICATION_USER 是放在不同的位置的！！！！

@sxyandapp commented on GitHub (Apr 24, 2025): 我也刚意识到 ENABLE_REVERSE_PROXY_AUTHENTICATION 和 REVERSE_PROXY_AUTHENTICATION_EMAIL/REVERSE_PROXY_AUTHENTICATION_USER 是放在不同的位置的！！！！

GiteaMirror commented

2025-11-02 11:06:29 -06:00

@lunny commented on GitHub (Apr 24, 2025):

Please follow the documentation. This should be a legacy problem.

@lunny commented on GitHub (Apr 24, 2025): Please follow the documentation. This should be a legacy problem.

GiteaMirror commented

2025-11-02 11:06:29 -06:00

@GiteaBot commented on GitHub (May 26, 2025):

We close issues that need feedback from the author if there were no new comments for a month. 🍵

@GiteaBot commented on GitHub (May 26, 2025): We close issues that need feedback from the author if there were no new comments for a month. :tea:

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14210