Using Sudo feature when authenticated with access_key from app created by admin user #2909

New Issue

GiteaMirror · 2025-11-02T04:53:35-06:00

GiteaMirror commented

2025-11-02 04:53:35 -06:00

Originally created by @DrMegavolt on GitHub (Feb 13, 2019).

Hello,

Documentation says I can use Sudo header to execute requests on behalf of user if I have admin user.

I do have admin user and I can execute requests as another user but only in case I have basic auth credentials. If I create application for admin user, grab access_token from it and try to call with sudo I will have 401\403 with message like Only administrators allowed to sudo.

Question:
Is it required that I use basic auth for Sudo usage or I can somehow use application access_token created by admin user?

Gitea version (or commit ref): 7a72aa6
Git version:
Operating system: Ubuntu
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
  if you have admin account and create app for it you should be able to reproduce (I don't have admin account on try.gitea.io)
Log gist:

Description

Thank you

Originally created by @DrMegavolt on GitHub (Feb 13, 2019). Hello, Documentation says I can use `Sudo` header to execute requests on behalf of user if I have admin user. I do have admin user and I can execute requests as another user but only in case I have basic auth credentials. If I create application for admin user, grab access_token from it and try to call with sudo I will have 401\403 with message like `Only administrators allowed to sudo.` Question: Is it required that I use basic auth for Sudo usage or I can somehow use `application` access_token created by admin user? - Gitea version (or commit ref): 7a72aa6 - Git version: - Operating system: Ubuntu - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [x] No - [ ] Not relevant if you have admin account and create app for it you should be able to reproduce (I don't have admin account on try.gitea.io) - Log gist: ## Description Thank you

GiteaMirror added the type/question label 2025-11-02 04:53:35 -06:00

GiteaMirror closed this issue

2025-11-02 04:53:36 -06:00

GiteaMirror commented

2025-11-02 04:53:37 -06:00

@DrMegavolt commented on GitHub (Feb 13, 2019):

And there is a test that seems to do what I'm trying to do 7096085f2b/integrations/api_admin_test.go (L81)

getTokenForLoggedInUser just gets token from the /user/settings/applications page

So when I try to replicate the test even without sudo I have 401
curl -X GET "http://localhost:3000/api/v1/user" -H "accept: application/json" -H "Authorization: 477362f41f3b656faafaf53e1fb81b63ff1e505d"

@DrMegavolt commented on GitHub (Feb 13, 2019): And there is a test that seems to do what I'm trying to do https://github.com/go-gitea/gitea/blob/7096085f2b07246315e95e394b180ce9729efbb0/integrations/api_admin_test.go#L81 `getTokenForLoggedInUser` just gets token from the `/user/settings/applications` page So when I try to replicate the test even without sudo I have 401 curl -X GET "http://localhost:3000/api/v1/user" -H "accept: application/json" -H "Authorization: 477362f41f3b656faafaf53e1fb81b63ff1e505d"

GiteaMirror commented

2025-11-02 04:53:37 -06:00

@zeripath commented on GitHub (Feb 14, 2019):

Your Authorization header is missing the token type. It should be:

Authorization: token $TOKEN_VALUE

IIRC token must be lowercase.

http Basic authentication is done using the Authorization header too, but with the type set to Basic. (Capitalisation may be slightly different.)

@zeripath commented on GitHub (Feb 14, 2019): Your Authorization header is missing the token type. It should be: `Authorization: token $TOKEN_VALUE` IIRC token must be lowercase. http Basic authentication is done using the Authorization header too, but with the type set to Basic. (Capitalisation may be slightly different.)

GiteaMirror commented

2025-11-02 04:53:37 -06:00

@DrMegavolt commented on GitHub (Feb 14, 2019):

thank you! it works

@DrMegavolt commented on GitHub (Feb 14, 2019): thank you! it works

GiteaMirror referenced this issue

2025-11-02 12:15:42 -06:00

[PR #2909] [MERGED] Gogs -> Gitea #16658

Sign in to join this conversation.