Use POST to change user selected language #5059

New Issue

GiteaMirror · 2025-11-02T06:12:42-06:00

GiteaMirror commented

2025-11-02 06:12:42 -06:00

Originally created by @techknowlogick on GitHub (Mar 14, 2020).

Looking at logs of various Gitea instances, many robots crawl the change language functionality resulting in many additional pages indexed.

Perhaps we could change the "switch user language" functionality to POST so that a GET isn't an action that changes something. Similar to how logout, star, and user follow actions work now. I'm thinking an endpoint /switch_user_language, and a return_to query param to bring the user back to the page that they were on.

Originally created by @techknowlogick on GitHub (Mar 14, 2020). Looking at logs of various Gitea instances, many robots crawl the change language functionality resulting in many additional pages indexed. Perhaps we could change the "switch user language" functionality to POST so that a GET isn't an action that changes something. Similar to how logout, star, and user follow actions work now. I'm thinking an endpoint `/switch_user_language`, and a `return_to` query param to bring the user back to the page that they were on.

GiteaMirror added the issue/confirmed type/enhancement labels 2025-11-02 06:12:42 -06:00

GiteaMirror closed this issue

2025-11-02 06:12:42 -06:00

GiteaMirror commented

2025-11-02 06:12:43 -06:00

@stale[bot] commented on GitHub (May 13, 2020):

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

@stale[bot] commented on GitHub (May 13, 2020): This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

GiteaMirror commented

2025-11-02 06:12:43 -06:00

@techknowlogick commented on GitHub (May 25, 2020):

So some investigation into this:

The i18n library we use already supports accepting language change requests via POST already

> http --form POST https://codeberg.org/explore/repos lang='es-ES'                                                                                                                             
HTTP/1.1 404 Not Found
Connection: close
Content-Type: text/html; charset=UTF-8
Set-Cookie: lang=es-ES; Path=/; Max-Age=2147483647; Secure;SameSite
....

Now, of course we can't have a POST to every route changing languages as not all routes support GETs (as we can see from my example that the explore page 404s), this means that no logic for handling changing language needs to be added, however an approach like I suggested above (using a special route) may be the best path. The special route, instead of handling language changes, would just redirect the user back to the page they were on. Redirects are always a tricky thing when it comes to security, but likely any concerns can be alleviated using CSRF params in the form.

@techknowlogick commented on GitHub (May 25, 2020): So some investigation into this: The i18n library we use already supports accepting language change requests via POST already ``` > http --form POST https://codeberg.org/explore/repos lang='es-ES' HTTP/1.1 404 Not Found Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: lang=es-ES; Path=/; Max-Age=2147483647; Secure;SameSite .... ```` Now, of course we can't have a POST to every route changing languages as not all routes support GETs (as we can see from my example that the explore page 404s), this means that no logic for handling changing language needs to be added, however an approach like I suggested above (using a special route) may be the best path. The special route, instead of handling language changes, would just redirect the user back to the page they were on. Redirects are always a tricky thing when it comes to security, but likely any concerns can be alleviated using CSRF params in the form.

GiteaMirror commented

2025-11-02 06:12:43 -06:00

@silverwind commented on GitHub (Aug 1, 2020):

Can we just use an Ajax call to change the language and then perform a page reload?

There's also a unnecessary ?lang=de-DE added to the URL after changing language which should no longer be an issue after Ajax.

@silverwind commented on GitHub (Aug 1, 2020): Can we just use an Ajax call to change the language and then perform a page reload? There's also a unnecessary `?lang=de-DE` added to the URL after changing language which should no longer be an issue after Ajax.

GiteaMirror referenced this issue

2025-11-02 14:30:46 -06:00

[PR #5059] [MERGED] Update vendor/golang.org/x/sys #17618

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#5059