Basic authentication doesn't work for archive downloads #14764

New Issue

GiteaMirror · 2025-11-02T11:22:24-06:00

GiteaMirror commented

2025-11-02 11:22:24 -06:00

Originally created by @pvgoran on GitHub (Jul 15, 2025).

Description

I have a private repository, and I need to download its archives (URLs like https://my.gitea.site/owner/repo/archive/.tar.gz) non-interactively using Basic Authentication. (Specifically, I need to download with the builtins.fetchTarball function of Nix package manager.) It doesn't work out of the box:

> > curl --dump-header - -u :REDACTED -o /dev/null https://REDACTED/REDACTED/REDACTED/archive/REDACTED.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/2 303 
server: nginx
date: Tue, 15 Jul 2025 15:13:01 GMT
content-type: text/html; charset=utf-8
content-length: 38
cache-control: max-age=0, private, must-revalidate, no-transform
location: /user/login
set-cookie: session=e685bd6a270841fa; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _csrf=YObR-Ve7B-AnJXJtfpjTtk5YrUA6MTc1MjU5MjM4MTk0ODAwNDg1Ng; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax
set-cookie: redirect_to=%2FREDACTED.tar.gz; Path=/; HttpOnly; Secure; SameSite=Lax
x-frame-options: SAMEORIGIN

100    38  100    38    0     0    608      0 --:--:-- --:--:-- --:--:--   612

(The password specified in curl's -u option is an Access Token with the read:repository permission of a user that is allowed to access the repository.)

I use a patched version of Gitea to make it work.

Gitea Version

1.24.2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

2025/07/15 15:19:55 ...eb/routing/logger.go:102:func1() [I] router: completed GET /REDACTED/REDACTED/archive/REDACTED.tar.gz for 127.0.0.1:34664, 303 See Other in 0.5ms @ web/web.go:139(web.registerWebRoutes.verifyAuthWithOptions)

Screenshots

No response

Git Version

2.49.0

Operating System

NixOS

How are you running Gitea?

NixOS' gitea module with the standard Nixpkgs' gitea package, behind Nginx reverse proxy.

Database

PostgreSQL

Originally created by @pvgoran on GitHub (Jul 15, 2025). ### Description I have a private repository, and I need to download its archives (URLs like https://my.gitea.site/owner/repo/archive/<commit-id>.tar.gz) non-interactively using Basic Authentication. (Specifically, I need to download with the `builtins.fetchTarball` function of [Nix package manager](https://nixos.org/).) It doesn't work out of the box: ``` > > curl --dump-header - -u :REDACTED -o /dev/null https://REDACTED/REDACTED/REDACTED/archive/REDACTED.tar.gz % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0HTTP/2 303 server: nginx date: Tue, 15 Jul 2025 15:13:01 GMT content-type: text/html; charset=utf-8 content-length: 38 cache-control: max-age=0, private, must-revalidate, no-transform location: /user/login set-cookie: session=e685bd6a270841fa; Path=/; HttpOnly; Secure; SameSite=Lax set-cookie: _csrf=YObR-Ve7B-AnJXJtfpjTtk5YrUA6MTc1MjU5MjM4MTk0ODAwNDg1Ng; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax set-cookie: redirect_to=%2FREDACTED.tar.gz; Path=/; HttpOnly; Secure; SameSite=Lax x-frame-options: SAMEORIGIN 100 38 100 38 0 0 608 0 --:--:-- --:--:-- --:--:-- 612 ``` (The password specified in curl's `-u` option is an Access Token with the `read:repository` permission of a user that is allowed to access the repository.) I use a patched version of Gitea to make it work. ### Gitea Version 1.24.2 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist 2025/07/15 15:19:55 ...eb/routing/logger.go:102:func1() [I] router: completed GET /REDACTED/REDACTED/archive/REDACTED.tar.gz for 127.0.0.1:34664, 303 See Other in 0.5ms @ web/web.go:139(web.registerWebRoutes.verifyAuthWithOptions) ### Screenshots _No response_ ### Git Version 2.49.0 ### Operating System NixOS ### How are you running Gitea? NixOS' `gitea` module with the standard Nixpkgs' `gitea` package, behind Nginx reverse proxy. ### Database PostgreSQL

GiteaMirror added the type/bug label 2025-11-02 11:22:24 -06:00

GiteaMirror closed this issue

2025-11-02 11:22:24 -06:00

GiteaMirror commented

2025-11-02 11:22:25 -06:00

@pvgoran commented on GitHub (Jul 15, 2025):

Here is the patch that allows me to make archive downloads working:

diff --git a/services/auth/basic.go b/services/auth/basic.go
index 1184d12d1c4b..bc3c9b67586e 100644
--- a/services/auth/basic.go
+++ b/services/auth/basic.go
@@ -42,8 +42,8 @@ func (b *Basic) Name() string {
 // name/token on successful validation.
 // Returns nil if header is empty or validation fails.
 func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
-       // Basic authentication should only fire on API, Download or on Git or LFSPaths
-       if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) {
+       // Basic authentication should only fire on API, Download, Archives or on Git or LFSPaths
+       if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isArchivePath(req) && !isGitRawOrAttachOrLFSPath(req) {
                return nil, nil
        }

(It won't apply on main because of https://github.com/go-gitea/gitea/pull/33371.)

@pvgoran commented on GitHub (Jul 15, 2025): Here is the patch that allows me to make archive downloads working: ```patch diff --git a/services/auth/basic.go b/services/auth/basic.go index 1184d12d1c4b..bc3c9b67586e 100644 --- a/services/auth/basic.go +++ b/services/auth/basic.go @@ -42,8 +42,8 @@ func (b *Basic) Name() string { // name/token on successful validation. // Returns nil if header is empty or validation fails. func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) { - // Basic authentication should only fire on API, Download or on Git or LFSPaths - if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) { + // Basic authentication should only fire on API, Download, Archives or on Git or LFSPaths + if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isArchivePath(req) && !isGitRawOrAttachOrLFSPath(req) { return nil, nil } ``` (It won't apply on `main` because of https://github.com/go-gitea/gitea/pull/33371.)

GiteaMirror commented

2025-11-02 11:22:25 -06:00

@pvgoran commented on GitHub (Jul 15, 2025):

Related issues:
#27204 (fixed by #27486)
#32458 (fixed by #33371)

@pvgoran commented on GitHub (Jul 15, 2025): Related issues: #27204 (fixed by #27486) #32458 (fixed by #33371)

GiteaMirror commented

2025-11-02 11:22:25 -06:00

@wxiaoguang commented on GitHub (Jul 15, 2025):

(It won't apply on main because of #33371.)

Then it should be like this on main:

diff --git a/services/auth/basic.go b/services/auth/basic.go
index b2bd14ef5d..4be1ed042c 100644
--- a/services/auth/basic.go
+++ b/services/auth/basic.go
@@ -49,7 +49,7 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
        // Basic authentication should only fire on API, Feed, Download or on Git or LFSPaths
        // Not all feed (rss/atom) clients feature the ability to add cookies or headers, so we need to allow basic auth for feeds
        detector := newAuthPathDetector(req)
-       if !detector.isAPIPath() && !detector.isFeedRequest(req) && !detector.isContainerPath() && !detector.isAttachmentDownload() && !detector.isGitRawOrAttachOrLFSPath() {
+       if !detector.isAPIPath() && !detector.isFeedRequest(req) && !detector.isContainerPath() && !detector.isAttachmentDownload() && !detector.isGitRawOrAttachOrLFSPath() && !detector.isArchivePath() {
                return nil, nil
        }

@wxiaoguang commented on GitHub (Jul 15, 2025): > (It won't apply on `main` because of [#33371](https://github.com/go-gitea/gitea/pull/33371).) Then it should be like this on main: ```diff diff --git a/services/auth/basic.go b/services/auth/basic.go index b2bd14ef5d..4be1ed042c 100644 --- a/services/auth/basic.go +++ b/services/auth/basic.go @@ -49,7 +49,7 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore // Basic authentication should only fire on API, Feed, Download or on Git or LFSPaths // Not all feed (rss/atom) clients feature the ability to add cookies or headers, so we need to allow basic auth for feeds detector := newAuthPathDetector(req) - if !detector.isAPIPath() && !detector.isFeedRequest(req) && !detector.isContainerPath() && !detector.isAttachmentDownload() && !detector.isGitRawOrAttachOrLFSPath() { + if !detector.isAPIPath() && !detector.isFeedRequest(req) && !detector.isContainerPath() && !detector.isAttachmentDownload() && !detector.isGitRawOrAttachOrLFSPath() && !detector.isArchivePath() { return nil, nil } ```

GiteaMirror commented

2025-11-02 11:22:25 -06:00

@pvgoran commented on GitHub (Jul 15, 2025):

Then it should be like this on main:

Well, I'd rather place !detector.isArchivePath() after !detector.isAttachmentDownload() rather than at the end, and also the comment above needs to be updated, too.

I'm going to create a proper PR when I have some more free time.

@pvgoran commented on GitHub (Jul 15, 2025): > Then it should be like this on main: Well, I'd rather place `!detector.isArchivePath()` after `!detector.isAttachmentDownload()` rather than at the end, and also the comment above needs to be updated, too. I'm going to create a proper PR when I have some more free time.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14764