Lang cookie missing secure/httpOnly attributes #4622

New Issue

GiteaMirror · 2025-11-02T05:56:28-06:00

GiteaMirror commented

2025-11-02 05:56:28 -06:00

Originally created by @tgurr on GitHub (Jan 10, 2020).

Gitea version: 1.10.2
Git version: 2.24.0
Operating system: Linux
Database:
- MySQL
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)

Description

I've configured my Gitea instance with CSRF_COOKIE_HTTP_ONLY and COOKIE_SECURE:

; Set false to allow JavaScript to read CSRF cookie
CSRF_COOKIE_HTTP_ONLY              = true
; If you use session in https only, default is false
COOKIE_SECURE     = true

which works fine, except for the lang cookie that doesn't seem to respect that setting:

resulting in a security scanner complaining about the cookie missing the secure and httpOnly attributes.

Originally created by @tgurr on GitHub (Jan 10, 2020). - Gitea version: 1.10.2 - Git version: 2.24.0 - Operating system: Linux - Database: - [X] MySQL - Can you reproduce the bug at https://try.gitea.io: - [X] Yes (provide example URL) ![gitea_cookies_trygiteaio](https://user-images.githubusercontent.com/414984/72142966-28275a00-3396-11ea-89ba-8d3bc20ad2d2.png) ## Description I've configured my Gitea instance with `CSRF_COOKIE_HTTP_ONLY` and `COOKIE_SECURE`: ``` ; Set false to allow JavaScript to read CSRF cookie CSRF_COOKIE_HTTP_ONLY = true ; If you use session in https only, default is false COOKIE_SECURE = true ``` which works fine, except for the lang cookie that doesn't seem to respect that setting: ![gitea_cookies](https://user-images.githubusercontent.com/414984/72142971-2c537780-3396-11ea-80b7-04e5fe8ff08a.png) resulting in a security scanner complaining about the cookie missing the `secure` and `httpOnly` attributes.

GiteaMirror added the topic/security label 2025-11-02 05:56:28 -06:00

GiteaMirror closed this issue

2025-11-02 05:56:28 -06:00

GiteaMirror commented

2025-11-02 05:56:29 -06:00

@rodolpheh commented on GitHub (Aug 13, 2020):

I think it all boils down to the i18n module for macaron-go : 5a5348d12f/i18n.go (L202)

@rodolpheh commented on GitHub (Aug 13, 2020): I think it all boils down to the i18n module for macaron-go : https://github.com/go-macaron/i18n/blob/5a5348d12f10480196f7376cf48de94fa93eb236/i18n.go#L202

GiteaMirror commented

2025-11-02 05:56:29 -06:00

@rodolpheh commented on GitHub (Aug 13, 2020):

My bad, I just saw that i18n in Gitea is a fork. Anyway, the changes I tried to introduce in https://github.com/go-macaron/i18n/pull/11 works on the i18n version of Gitea. This was tested on a Docker build with latest sources.

@rodolpheh commented on GitHub (Aug 13, 2020): My bad, I just saw that i18n in Gitea is a fork. Anyway, the changes I tried to introduce in https://github.com/go-macaron/i18n/pull/11 works on the i18n version of Gitea. This was tested on a Docker build with latest sources. ![image](https://user-images.githubusercontent.com/4491499/90136624-c0465100-dd74-11ea-9ff5-00993bceeb6e.png)

GiteaMirror commented

2025-11-02 05:56:29 -06:00

@tgurr commented on GitHub (Dec 30, 2020):

@rodolpheh thanks for your work! Looks like the changes also have been pulled into the i18n Gitea fork in the meantime. Is there any option which allows to enable this or is currently the only way to enable/test this to manually change the settings which are off by default in i18n.go before compiling Gitea?

@tgurr commented on GitHub (Dec 30, 2020): @rodolpheh thanks for your work! Looks like the changes also have been pulled into the i18n Gitea fork in the meantime. Is there any option which allows to enable this or is currently the only way to enable/test this to manually change the settings which are off by default in i18n.go before compiling Gitea?

GiteaMirror commented

2025-11-02 05:56:29 -06:00

@rodolpheh commented on GitHub (Dec 31, 2020):

Sorry I have a terrible memory and barely remembered doing that 😄 . Unfortunately it seems that I haven't pushed any changes that would allow setting those in Gitea. I had to dig a little before finding what I had changed in Gitea to make it work. Please find attached a patch file until a proper push is made on Gitea. I pulled the latest sources to make sure this works so hopefully it should work for you.

After applying this patch, the Secure and HttpOnly flags should be added if you had COOKIE_SECURE and CSRF_COOKIE_HTTP_ONLY set to true in your app settings.

macaron.go.patch.txt

@rodolpheh commented on GitHub (Dec 31, 2020): Sorry I have a terrible memory and barely remembered doing that :smile: . Unfortunately it seems that I haven't pushed any changes that would allow setting those in Gitea. I had to dig a little before finding what I had changed in Gitea to make it work. Please find attached a patch file until a proper push is made on Gitea. I pulled the latest sources to make sure this works so hopefully it should work for you. After applying this patch, the Secure and HttpOnly flags should be added if you had COOKIE_SECURE and CSRF_COOKIE_HTTP_ONLY set to true in your app settings. [macaron.go.patch.txt](https://github.com/go-gitea/gitea/files/5757121/macaron.go.patch.txt)

GiteaMirror commented

2025-11-02 05:56:29 -06:00

@tgurr commented on GitHub (Jan 4, 2021):

@rodolpheh Thanks for the hint, I couldn't apply your patch, probably because I build from source so I had no /routers/routes/macaron.go b/routers/routes/macaron.go file to begin with.

Based on your patch I went with this: gitea-1.13.1-lang-cookie.txt. Not sure if it's ready for a PR like it is, but it appears to do the trick:

@tgurr commented on GitHub (Jan 4, 2021): @rodolpheh Thanks for the hint, I couldn't apply your patch, probably because I build from source so I had no `/routers/routes/macaron.go b/routers/routes/macaron.go` file to begin with. Based on your patch I went with this: [gitea-1.13.1-lang-cookie.txt](https://github.com/go-gitea/gitea/files/5763573/gitea-1.13.1-lang-cookie.txt). Not sure if it's ready for a PR like it is, but it appears to do the trick: ![Screenshot_20210104_083856](https://user-images.githubusercontent.com/414984/103512972-fbebcf80-4e69-11eb-9e7d-b99eb3c1fde6.png)

GiteaMirror referenced this issue

2025-11-02 13:21:47 -06:00

[PR #4622] [MERGED] Fix Split-View line adjustment #17436

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#4622