Fix api uses in the web ui #2477

New Issue

GiteaMirror · 2025-11-02T04:37:51-06:00

GiteaMirror commented

2025-11-02 04:37:51 -06:00

Originally created by @kolaente on GitHub (Nov 1, 2018).

#4840 introduced some significant changes to the way the authentication for the api works. It broke some things where the web ui called the api, namely:

https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1459
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1486
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2087
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2507
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2594
https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2630

We have two possibilities to solve this:

Either call the routes using an api token
Accept using a cookie, but if using a cookie, some kind of crf token to validate the request

IMHO the first solution would be cleaner because if an attacker has a cookie he/she could easily use that to get a new api request token via the web ui, rendering the whole double-check useless. So we could save the hassle to implement the double check with cookie/crf token and use the mechanism which is already there.

Originally created by @kolaente on GitHub (Nov 1, 2018). #4840 introduced some significant changes to the way the authentication for the api works. It broke some things where the web ui called the api, namely: https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1459 https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1486 https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2087 https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2507 https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2594 https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2630 We have two possibilities to solve this: * Either call the routes using an api token * Accept using a cookie, but if using a cookie, some kind of crf token to validate the request IMHO the first solution would be cleaner because if an attacker has a cookie he/she could easily use that to get a new api request token via the web ui, rendering the whole double-check useless. So we could save the hassle to implement the double check with cookie/crf token and use the mechanism which is already there.

GiteaMirror added the issue/stale modifies/api labels 2025-11-02 04:37:51 -06:00

GiteaMirror closed this issue

2025-11-02 04:37:51 -06:00

GiteaMirror commented

2025-11-02 04:37:52 -06:00

@techknowlogick commented on GitHub (Nov 1, 2018):

@kolaente a malicious user wouldn't need the cookie to be able to post to the API. They could create a form on a different domain that POSTs to the API, and because the user has the cookie the API would accept it, which is why the CSRF would be needed.

Option 2 would be better than 1 because the CSRF is shortlived and autogenerated, and an API token is long living, so I believe 2 is cleaner.

@techknowlogick commented on GitHub (Nov 1, 2018): @kolaente a malicious user wouldn't need the cookie to be able to post to the API. They could create a `form` on a different domain that POSTs to the API, and because the user has the cookie the API would accept it, which is why the CSRF would be needed. Option 2 would be better than 1 because the CSRF is shortlived and autogenerated, and an API token is long living, so I believe 2 is cleaner.

GiteaMirror commented

2025-11-02 04:37:52 -06:00

@zeripath commented on GitHub (Nov 1, 2018):

OK The list above appears to map to the following urls:

GET /api/v1/users/search?...
- https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1459
GET /api/v1/repos/search?...
- https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1486
- https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2087
GET /api/v1/topics/search?...
- https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2507
POST /api/v1/repos/{owner}/{repo}/issues/{issue}/deadline
- https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2594
GET /api/v1/repos/{owner}/{repo}/issues?q={query}
- https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2630

@zeripath commented on GitHub (Nov 1, 2018): OK The list above appears to map to the following urls: - `GET /api/v1/users/search?...` * https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1459 - `GET /api/v1/repos/search?...` * https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L1486 * https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2087 - `GET /api/v1/topics/search?...` * https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2507 - `POST /api/v1/repos/{owner}/{repo}/issues/{issue}/deadline` * https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2594 - `GET /api/v1/repos/{owner}/{repo}/issues?q={query}` * https://github.com/go-gitea/gitea/blob/master/public/js/index.js#L2630

GiteaMirror commented

2025-11-02 04:37:53 -06:00

@zeripath commented on GitHub (Nov 1, 2018):

Looking at the code, and following some rudimentary testing I'm not convinced that the GET urls are affected.

@zeripath commented on GitHub (Nov 1, 2018): Looking at the code, and following some rudimentary testing I'm not convinced that the GET urls are affected.

GiteaMirror commented

2025-11-02 04:37:53 -06:00

@kolaente commented on GitHub (Nov 1, 2018):

@zeripath The issue search does not work when on a private repo, user search shouldn't work either, neither should topic search.

@kolaente commented on GitHub (Nov 1, 2018): @zeripath The issue search does not work when on a private repo, user search shouldn't work either, neither should topic search.

GiteaMirror commented

2025-11-02 04:37:53 -06:00

@lafriks commented on GitHub (Nov 15, 2018):

I would prefer to stick to current behaviour to not use API for UI

@lafriks commented on GitHub (Nov 15, 2018): I would prefer to stick to current behaviour to not use API for UI

GiteaMirror commented

2025-11-02 04:37:54 -06:00

@zeripath commented on GitHub (Nov 15, 2018):

@lafriks I'm not sure I understand.

@zeripath commented on GitHub (Nov 15, 2018): @lafriks I'm not sure I understand.

GiteaMirror commented

2025-11-02 04:37:54 -06:00

@lafriks commented on GitHub (Nov 16, 2018):

I meant that we should create routes that would be called for getting data for UI and not call API routes

@lafriks commented on GitHub (Nov 16, 2018): I meant that we should create routes that would be called for getting data for UI and not call API routes

GiteaMirror commented

2025-11-02 04:37:54 -06:00

@stale[bot] commented on GitHub (Jan 15, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 15, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 04:37:55 -06:00

@stale[bot] commented on GitHub (Feb 19, 2019):

This issue has been automatically closed because of inactivity. You can re-open it if needed.

@stale[bot] commented on GitHub (Feb 19, 2019): This issue has been automatically closed because of inactivity. You can re-open it if needed.

GiteaMirror referenced this issue

2025-11-02 12:10:12 -06:00

[PR #2477] [MERGED] Fix #2470 #16419

Sign in to join this conversation.