2FA Yubikey Neo not working in Chrome (yet ok in Firefox) after upgrade to 1.8.1 #3304

New Issue

GiteaMirror · 2025-11-02T05:07:24-06:00

GiteaMirror commented

2025-11-02 05:07:24 -06:00

Originally created by @stefanomarty on GitHub (May 9, 2019).

Gitea version (or commit ref): 1.8.1
Git version:
Operating system: Debian Jessie
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

2FA by Yubikey is not working after upgrade to 1.8.1. I get the same error on https://try.gitea.io
I follow these steps, using Chrome:

register new account
enroll 2FA with Google Authenticator
add Yubikey device (recognized and regularly added)
logout
trying to login shows this message:
Could not read your security key.
Please make sure to use the correct, encrypted (https://) URL.

The same sequence using Firefox works fine, even if I need to touch the Yubikey twice to get in (I usually touch it just once while authenticating on other sites).

I had a similar issue in the past, and I had solved it by stripping the trailing slash in APP_ID and TRUSTED_FACETS definitions in custom/conf/app.ini:

[U2F]
; Two Factor authentication with security keys
; https://developers.yubico.com/U2F/App_ID.html
;APP_ID         = https://my.domain.com/   <-- not working
APP_ID         = https://my.domain.com   <-- WORKING
; Comma separated list of trusted facets
;TRUSTED_FACETS = https://my.domain.com/   <-- not working
TRUSTED_FACETS = https://my.domain.com   <-- WORKING

After upgrading to 1.8.1 I get the error even with these settings.

Again, no errors with Firefox. But no errors as well while using Yubikey with Chrome on github.com

...

Screenshots

Originally created by @stefanomarty on GitHub (May 9, 2019).   - Gitea version (or commit ref): 1.8.1 - Git version: - Operating system: Debian Jessie - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL) - [ ] No - [ ] Not relevant - Log gist: ## Description 2FA by Yubikey is not working after upgrade to 1.8.1. I get the same error on https://try.gitea.io I follow these steps, using Chrome: - register new account - enroll 2FA with Google Authenticator - add Yubikey device (recognized and regularly added) - logout - trying to login shows this message: _**Could not read your security key. Please make sure to use the correct, encrypted (https://) URL.**_ The same sequence using Firefox works fine, even if I need to touch the Yubikey twice to get in (I usually touch it just once while authenticating on other sites). I had a similar issue in the past, and I had solved it by stripping the trailing slash in APP_ID and TRUSTED_FACETS definitions in custom/conf/app.ini: ``` [U2F] ; Two Factor authentication with security keys ; https://developers.yubico.com/U2F/App_ID.html ;APP_ID = https://my.domain.com/ <-- not working APP_ID = https://my.domain.com <-- WORKING ; Comma separated list of trusted facets ;TRUSTED_FACETS = https://my.domain.com/ <-- not working TRUSTED_FACETS = https://my.domain.com <-- WORKING ``` After upgrading to 1.8.1 I get the error even with these settings. Again, no errors with Firefox. But no errors as well while using Yubikey with Chrome on github.com ... ## Screenshots  <img width="721" alt="Schermata 2019-05-09 alle 10 39 32" src="https://user-images.githubusercontent.com/3297621/57441692-bf0da680-724a-11e9-8674-bf9b39e8dcce.png">

GiteaMirror added the issue/duplicate label 2025-11-02 05:07:24 -06:00

GiteaMirror closed this issue

2025-11-02 05:07:24 -06:00

GiteaMirror commented

2025-11-02 05:07:25 -06:00

@stefanomarty commented on GitHub (May 9, 2019):

After checking older issues, I found #6748, so it looks like this is a Chrome issue: I'm using Chrome 74 and I probably didn't notice it previously because I was already logged in and didn't need to use the Yubikey. I tried reinstalling Gitea v.1.8.0 and the issue is there as well, so it's not related to Gitea upgrade to v.1.8.1.

Anyway, there must be something to check in the Gitea code, as this error is not showing on other websites, like github.com, where the Yubikey is functioning with Chrome 74. Sorry not to be more helpful, but that analysis goes beyond my skills.

@stefanomarty commented on GitHub (May 9, 2019): After checking older issues, I found [#6748](https://github.com/go-gitea/gitea/issues/6748), so it looks like this is a Chrome issue: I'm using Chrome 74 and I probably didn't notice it previously because I was already logged in and didn't need to use the Yubikey. I tried reinstalling Gitea v.1.8.0 and the issue is there as well, so it's not related to Gitea upgrade to v.1.8.1. Anyway, there must be something to check in the Gitea code, as this error is not showing on other websites, like github.com, where the Yubikey is functioning with Chrome 74. Sorry not to be more helpful, but that analysis goes beyond my skills.

GiteaMirror referenced this issue

2025-11-02 12:22:35 -06:00

[PR #3429] [MERGED] Add sensitive headers #16940

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#3304