404 when not logged in and trying to access a private repo #3594

New Issue

GiteaMirror · 2025-11-02T05:18:30-06:00

GiteaMirror commented

2025-11-02 05:18:30 -06:00

Originally created by @bohwaz on GitHub (Jul 15, 2019).

Gitea version (or commit ref): 1.8.3

Gitea shows a 404 page when trying to access a private repo if you are not logged in.

We find that this is disturbing for users, as there is no suggestion that the user should log in to access the repo. Most users just report that the repo doesn't work or that the URL we sent them doesn't work.

The error page should show something more useful than just 404, like a message saying that they need to login in order to access the repo.

Originally created by @bohwaz on GitHub (Jul 15, 2019). - Gitea version (or commit ref): 1.8.3 Gitea shows a 404 page when trying to access a private repo if you are not logged in. We find that this is disturbing for users, as there is no suggestion that the user should log in to access the repo. Most users just report that the repo doesn't work or that the URL we sent them doesn't work. The error page should show something more useful than just 404, like a message saying that they need to login in order to access the repo.

GiteaMirror added the issue/not-a-bug label 2025-11-02 05:18:30 -06:00

GiteaMirror closed this issue

2025-11-02 05:18:30 -06:00

GiteaMirror commented

2025-11-02 05:18:31 -06:00

@lunny commented on GitHub (Jul 15, 2019):

This is by designed for security reason.

@lunny commented on GitHub (Jul 15, 2019): This is by designed for security reason.

GiteaMirror commented

2025-11-02 05:18:32 -06:00

@bohwaz commented on GitHub (Jul 15, 2019):

I don't think it is? Private doesn't mean "secret" by any means?

And also it's quite a bad user experience.

@bohwaz commented on GitHub (Jul 15, 2019): I don't think it is? Private doesn't mean "secret" by any means? And also it's quite a bad user experience.

GiteaMirror commented

2025-11-02 05:18:32 -06:00

@jolheiser commented on GitHub (Jul 15, 2019):

This is the same way other projects handle it as well, like GitHub and Gitlab.

Private generally comes down to "I don't want other people (except maybe collaborators) to know this exists" for one reason or another.

One thing you could do is set REQUIRE_SIGNIN_VIEW to true in your app.ini
This would force anyone to log in before viewing a repo anyways, so if they have access they'd get in. If not, a 404 is still received as it should be.

@jolheiser commented on GitHub (Jul 15, 2019): This is the same way other projects handle it as well, like GitHub and Gitlab. Private generally comes down to "I don't want other people (except maybe collaborators) to know this exists" for one reason or another. One thing you could do is set `REQUIRE_SIGNIN_VIEW` to `true` in your `app.ini` This would force anyone to log in before viewing a repo anyways, so if they have access they'd get in. If not, a 404 is still received as it should be.

GiteaMirror commented

2025-11-02 05:18:32 -06:00

@bohwaz commented on GitHub (Jul 15, 2019):

Interesting. Would that require people viewing public repos to log in as well?

@bohwaz commented on GitHub (Jul 15, 2019): Interesting. Would that require people viewing public repos to log in as well?

GiteaMirror commented

2025-11-02 05:18:32 -06:00

@jolheiser commented on GitHub (Jul 15, 2019):

Yes it would.

@jolheiser commented on GitHub (Jul 15, 2019): Yes it would.

GiteaMirror commented

2025-11-02 05:18:32 -06:00