Disabling /api and /api/swagger endpoints #1522

@lafriks commented on GitHub (Feb 12, 2018):

What is use case for disabling API?

@lafriks commented on GitHub (Feb 12, 2018): What is use case for disabling API?

GiteaMirror commented

@0rzech commented on GitHub (Feb 12, 2018):

When one doesn't want to expose it at all, eg. to reduce attack surface.

@0rzech commented on GitHub (Feb 12, 2018): When one doesn't want to expose it at all, eg. to reduce attack surface.

GiteaMirror commented

@lafriks commented on GitHub (Feb 12, 2018):

You can use nginx in front of gitea and than disable everything starting with /api

@lafriks commented on GitHub (Feb 12, 2018): You can use nginx in front of gitea and than disable everything starting with `/api`

GiteaMirror commented

@0rzech commented on GitHub (Feb 12, 2018):

Yes, but the link to API will remain in footer.

@0rzech commented on GitHub (Feb 12, 2018): Yes, but the link to [API](https://try.gitea.io/api/swagger) will remain in footer.

GiteaMirror commented

@lafriks commented on GitHub (Feb 12, 2018):

It will not work anyway ;) not the best option but you can change template if that is really needed

@lafriks commented on GitHub (Feb 12, 2018): It will not work anyway ;) not the best option but you can change template if that is really needed

GiteaMirror commented

@0rzech commented on GitHub (Feb 12, 2018):

Yes, but IMHO it's a bit too dirty to change template and server configuration to achieve that.

@0rzech commented on GitHub (Feb 12, 2018): Yes, but IMHO it's a bit too dirty to change template and server configuration to achieve that.

GiteaMirror commented

@lafriks commented on GitHub (Feb 12, 2018):

Of course option to hide swagger link can be added

@lafriks commented on GitHub (Feb 12, 2018): Of course option to hide swagger link can be added

GiteaMirror commented

2025-11-02 04:03:48 -06:00

@0rzech commented on GitHub (Feb 12, 2018):

Cool. Thanks for your input.

@0rzech commented on GitHub (Feb 12, 2018): Cool. Thanks for your input.

GiteaMirror commented

@lunny commented on GitHub (Feb 17, 2018):

resolved by #3502

@lunny commented on GitHub (Feb 17, 2018): resolved by #3502

GiteaMirror commented

2025-11-02 04:03:48 -06:00

@shuhaowu commented on GitHub (Jun 13, 2018):

The other PR doesn't actually disable /api, right? Only /api/swagger (which is the documentation endpoint and try it out interface??) is disabled in that PR afaict.

Thus this is not quite resolved with that option. To work around this, you can disable access to /api in the reverse proxy setup link nginx on the node. The /api/internal endpoints should stay unaffected with this because gitea by default tries to build the internal API calls' urls via HTTP_ADDR:HTTP_PORT specified in the settings, which doesn't go through the reverse proxy locally. Just ensure that you only bind with HTTP_ADDR = 127.0.0.1.

@shuhaowu commented on GitHub (Jun 13, 2018): The other PR doesn't actually disable /api, right? Only /api/swagger (which is the documentation endpoint and try it out interface??) is disabled in that PR afaict. Thus this is not quite resolved with that option. To work around this, you can disable access to /api in the reverse proxy setup link nginx on the node. The /api/internal endpoints should stay unaffected with this because gitea by default tries to build the internal API calls' urls via HTTP_ADDR:HTTP_PORT specified in the settings, which doesn't go through the reverse proxy locally. Just ensure that you only bind with HTTP_ADDR = 127.0.0.1.

GiteaMirror commented

2025-11-02 04:03:48 -06:00

@lafriks commented on GitHub (Jun 13, 2018):

@shuhaowu not true, gitea also uses API for some functionality so it can not be disabled fully without loosing some functionality

@lafriks commented on GitHub (Jun 13, 2018): @shuhaowu not true, gitea also uses API for some functionality so it can not be disabled fully without loosing some functionality

GiteaMirror commented

@shuhaowu commented on GitHub (Jun 13, 2018):

Yeah but my work around shouldn't impact it? As I can see in the code, any API calls gitea does uses LocalURL, which is HTTP_ADDR:HTTP_PORT if running in the regular server mode, correct?

@shuhaowu commented on GitHub (Jun 13, 2018): Yeah but my work around shouldn't impact it? As I can see in the code, any API calls gitea does uses LocalURL, which is HTTP_ADDR:HTTP_PORT if running in the regular server mode, correct?

GiteaMirror commented

@0rzech commented on GitHub (Jul 30, 2018):

@shuhaowu Gitea front-end uses API as well. You can find it here. Just look for /api occurrences.

@0rzech commented on GitHub (Jul 30, 2018): @shuhaowu Gitea front-end uses API as well. You can find it [here](/go-gitea/gitea/blob/344dc07239301194fa4220a27ce4dd24396cf25c/public/js/index.js). Just look for `/api` occurrences.

GiteaMirror commented

@gerroon commented on GitHub (May 16, 2020):

What is use case for disabling API?

I just realized that non users can get user names without signed in, I do not know how this is not a security issue.

Here is from non public repo, using from terminal without any form of login indication. There is not even an API key involved.

curl -X GET "https://DOMAIN/GIT/gc/api/v1/users/search?q=USE" -H  "accept: application/json"


{"data":[{"id":0,"login":"USER","full_name":"","email":"","avatar_url":"https://DOMAIN/GIT/gc/user/avatar/USER/-1","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2018-05-21T22:45:38-05:00","username":"USER"}],"ok":true}

@gerroon commented on GitHub (May 16, 2020): > What is use case for disabling API? I just realized that non users can get user names without signed in, I do not know how this is not a security issue. Here is from non public repo, using from terminal without any form of login indication. There is not even an API key involved. ``` curl -X GET "https://DOMAIN/GIT/gc/api/v1/users/search?q=USE" -H "accept: application/json" {"data":[{"id":0,"login":"USER","full_name":"","email":"","avatar_url":"https://DOMAIN/GIT/gc/user/avatar/USER/-1","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2018-05-21T22:45:38-05:00","username":"USER"}],"ok":true} ```

GiteaMirror commented