Two-Factor Authentication key/QRCode is somehow cached in the browser #1862

New Issue

GiteaMirror · 2025-11-02T04:15:39-06:00

GiteaMirror commented

2025-11-02 04:15:39 -06:00

Originally created by @fnyu on GitHub (Jun 5, 2018).

Gitea version (or commit ref): 1.4.2
Git version: 2.17.0
Operating system: Ubuntu 18.04 LTS (Bionic Beaver)
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

I noticed a strange issue when trying to enable 2FA on my local Gitea instance. It turns out when:

I log in as User1, try to enable 2FA on the account
then relog to User2 account and go to the Security settings,

I get the same QR Code/Key as for the User1, along with User1 account login. Looks like it might be cached and related to some cookie, because if I log in as User2 using different browser it works flawlessly.

I know that users usually don't own 2 accounts and this is unlikely to happen in a normal use case, but it might be a more critical security issue that I am not aware of, and as I have no experience with Golang it is difficult for me to investigate it (although I try to) and fix it.

On the attached screenshot you can see that I am logged in as user proof2, but if you try to scan the QRCode it would have proof1 username in the title.

Screenshots

Originally created by @fnyu on GitHub (Jun 5, 2018).  - Gitea version (or commit ref): 1.4.2 - Git version: 2.17.0 - Operating system: Ubuntu 18.04 LTS (Bionic Beaver) - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: ## Description I noticed a strange issue when trying to enable 2FA on my local Gitea instance. It turns out when: * I log in as User1, try to enable 2FA on the account * then relog to User2 account and go to the Security settings, I get the same QR Code/Key as for the User1, along with User1 account login. Looks like it might be cached and related to some cookie, because if I log in as User2 using different browser it works flawlessly. I know that users usually don't own 2 accounts and this is unlikely to happen in a normal use case, but it might be a more critical security issue that I am not aware of, and as I have no experience with Golang it is difficult for me to investigate it (although I try to) and fix it. On the attached screenshot you can see that I am logged in as user `proof2`, but if you try to scan the QRCode it would have `proof1` username in the title. ## Screenshots ![screenshot](https://user-images.githubusercontent.com/22723539/40974683-8d45af8a-68c8-11e8-80ea-a482655e78a7.png)

GiteaMirror added the issue/stale type/bug labels 2025-11-02 04:15:39 -06:00

GiteaMirror closed this issue

2025-11-02 04:15:39 -06:00

GiteaMirror commented

2025-11-02 04:15:40 -06:00

@stale[bot] commented on GitHub (Jan 4, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 4, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 04:15:40 -06:00

@stale[bot] commented on GitHub (Feb 23, 2019):

This issue has been automatically closed because of inactivity. You can re-open it if needed.

@stale[bot] commented on GitHub (Feb 23, 2019): This issue has been automatically closed because of inactivity. You can re-open it if needed.

GiteaMirror referenced this issue

2025-11-02 12:02:08 -06:00

[PR #1862] [MERGED] Support CRLF when splitting code lines for display #16093

Sign in to join this conversation.