Able to clone via HTTPS anonymously #1599

New Issue

GiteaMirror · 2025-11-02T04:06:12-06:00

GiteaMirror commented

2025-11-02 04:06:12 -06:00

Originally created by @robetus on GitHub (Mar 6, 2018).

Gitea version (or commit ref): 1.4.0rc2
Git version: 2.7.4
Operating system: Ubuntu 16.04
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

The title really says it but apparently it looks like Gitea is setup to clone anonymously if you have HTTP enabled? Is that right? I tried on the demo and my live site with the same results. Is there any way currently to not enable an anonymous connection via HTTP, or do I need to disable HTTP all together?

Originally created by @robetus on GitHub (Mar 6, 2018).  - Gitea version (or commit ref): 1.4.0rc2 - Git version: 2.7.4 - Operating system: Ubuntu 16.04 - Database (use `[x]`): - [ ] PostgreSQL - [X] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [X] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: The title really says it but apparently it looks like Gitea is setup to clone anonymously if you have HTTP enabled? Is that right? I tried on the demo and my live site with the same results. Is there any way currently to not enable an anonymous connection via HTTP, or do I need to disable HTTP all together?

GiteaMirror added the type/question label 2025-11-02 04:06:12 -06:00

GiteaMirror closed this issue

2025-11-02 04:06:12 -06:00

GiteaMirror commented

2025-11-02 04:06:13 -06:00

@lafriks commented on GitHub (Mar 7, 2018):

set REQUIRE_SIGNIN_VIEW = true in app.ini and restart gitea after that to require authorization to access repositories

@lafriks commented on GitHub (Mar 7, 2018): set `REQUIRE_SIGNIN_VIEW = true` in `app.ini` and restart gitea after that to require authorization to access repositories

GiteaMirror commented

2025-11-02 04:06:13 -06:00

@robetus commented on GitHub (Mar 7, 2018):

Negative, I already had REQUIRE_SIGNIN_VIEW = true in my app.ini via an option I selected during the install. I also removed any ssh keys I had in my settings and it is still allowing me to clone anonymously via https. I also verified this just now again and it allowed me to clone anonymously.

@robetus commented on GitHub (Mar 7, 2018): Negative, I already had `REQUIRE_SIGNIN_VIEW = true` in my `app.ini` via an option I selected during the install. I also removed any ssh keys I had in my settings and it is still allowing me to clone anonymously via https. I also verified this just now again and it allowed me to clone anonymously. <img width="377" alt="reequired-signin" src="https://user-images.githubusercontent.com/8278397/37120123-c40fcf4c-2259-11e8-99f3-35709620af5c.png">

GiteaMirror commented

2025-11-02 04:06:13 -06:00

@lafriks commented on GitHub (Mar 7, 2018):

could be that you have cached credentials? Can you try to clone from other computer?

@lafriks commented on GitHub (Mar 7, 2018): could be that you have cached credentials? Can you try to clone from other computer?

GiteaMirror commented

2025-11-02 04:06:13 -06:00

@robetus commented on GitHub (Mar 7, 2018):

That could be it, do you know how I could clear the cache? I'm on a mac which I'm finding is a lot like linux. I'll try on one of my VMs soon to check.

@robetus commented on GitHub (Mar 7, 2018): That could be it, do you know how I could clear the cache? I'm on a mac which I'm finding is a lot like linux. I'll try on one of my VMs soon to check.

GiteaMirror commented

2025-11-02 04:06:14 -06:00

@lafriks commented on GitHub (Mar 7, 2018):

Don't know if this works on Mac but you can try: git credential-cache exit

@lafriks commented on GitHub (Mar 7, 2018): Don't know if this works on Mac but you can try: `git credential-cache exit`

GiteaMirror commented

2025-11-02 04:06:14 -06:00

@robetus commented on GitHub (Mar 7, 2018):

git credential-cache exit seemed like it worked on my mac but still let me clone anonymously. However I tired to clone on a VM and it did ask me for my username and password so success! My mac is caching my credentials. Thanks for the tip!

@robetus commented on GitHub (Mar 7, 2018): `git credential-cache exit` seemed like it worked on my mac but still let me clone anonymously. However I tired to clone on a VM and it did ask me for my username and password so success! My mac is caching my credentials. Thanks for the tip!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#1599