Too eager reverse proxy user autocreation #3365

New Issue

GiteaMirror · 2025-11-02T05:10:14-06:00

GiteaMirror commented

2025-11-02 05:10:14 -06:00

Originally created by @ptman on GitHub (May 22, 2019).

Gitea version (or commit ref): 1.8.1
Git version: docker
Operating system: docker
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite

Description

I have set ENABLE_REVERSE_PROXY_AUTHENTICATION = true and ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true. But I'm using the API, so I excepted /api (and static assets, such as /css, /js, /img) from mod_auth_mellon, which I use for authentication on apache (2.4). This causes mod_auth_mellon to only set the remote user header on the requests where it is used. In other cases the remote user header seems to contain nothing. But gitea still creates a user when requesting static assets. So I get a user called '(null)' which is recreated if I remove it.

Originally created by @ptman on GitHub (May 22, 2019). - Gitea version (or commit ref): 1.8.1 - Git version: docker - Operating system: docker - Database (use `[x]`): - [x] PostgreSQL - [ ] MySQL - [ ] MSSQL - [ ] SQLite ## Description I have set ENABLE_REVERSE_PROXY_AUTHENTICATION = true and ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = true. But I'm using the API, so I excepted /api (and static assets, such as /css, /js, /img) from mod_auth_mellon, which I use for authentication on apache (2.4). This causes mod_auth_mellon to only set the remote user header on the requests where it is used. In other cases the remote user header seems to contain nothing. But gitea still creates a user when requesting static assets. So I get a user called '(null)' which is recreated if I remove it.

GiteaMirror added the type/bug label 2025-11-02 05:10:14 -06:00

GiteaMirror closed this issue

2025-11-02 05:10:14 -06:00

GiteaMirror commented

2025-11-02 05:10:15 -06:00

@stale[bot] commented on GitHub (Jul 24, 2019):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jul 24, 2019): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 05:10:15 -06:00

@wxiaoguang commented on GitHub (Oct 26, 2022):

The code has changed a lot since 1.8

64c3d55de7/services/auth/reverseproxy.go (L55-L71)

Now, Gitea won't create a user if there is no username in header.

Feel free to re-open with more details if there is still a problem

@wxiaoguang commented on GitHub (Oct 26, 2022): The code has changed a lot since 1.8 https://github.com/go-gitea/gitea/blob/64c3d55de7f3a46b4b73a119f11b2d337ca4eaa6/services/auth/reverseproxy.go#L55-L71 Now, Gitea won't create a user if there is no username in header. Feel free to re-open with more details if there is still a problem

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#3365