public resources should not set redirect_to cookie #5242

New Issue

GiteaMirror · 2025-11-02T06:18:57-06:00

GiteaMirror commented

2025-11-02 06:18:57 -06:00

Originally created by @silverwind on GitHub (Apr 16, 2020).

/js/userheatmap.js is currently requested by the serviceworker which is a bug in itself but the request causes a bad cookie to be set when authentication is enabled:

Request URL: /js/userheatmap.js
Request Method: GET

status: 302
location: /user/login
set-cookie: redirect_to=%2Fjs%2Fuserheatmap.js; Path=/

The next time the user logs in with that cookie set, they will be redirected to /js/userheatmap.js which causes a page loading error. We should just 404 any requests that would be routed to a file in public, or at least the js/css/img/vendor folders.

Originally created by @silverwind on GitHub (Apr 16, 2020). `/js/userheatmap.js` is currently requested by the serviceworker which is a bug in itself but the request causes a bad cookie to be set when authentication is enabled: ``` Request URL: /js/userheatmap.js Request Method: GET ``` ``` status: 302 location: /user/login set-cookie: redirect_to=%2Fjs%2Fuserheatmap.js; Path=/ ```` The next time the user logs in with that cookie set, they will be redirected to /js/userheatmap.js which causes a page loading error. We should just 404 any requests that would be routed to a file in `public`, or at least the js/css/img/vendor folders.

GiteaMirror added the type/bug label 2025-11-02 06:18:57 -06:00

GiteaMirror closed this issue

2025-11-02 06:18:58 -06:00

GiteaMirror commented

2025-11-02 06:18:58 -06:00

@guillep2k commented on GitHub (Apr 17, 2020):

Fixed in #11091

@guillep2k commented on GitHub (Apr 17, 2020): Fixed in #11091

GiteaMirror commented

2025-11-02 06:18:58 -06:00

@silverwind commented on GitHub (Apr 17, 2020):

No, not fixed, it's just a workaround. Proper fix will be in the router, I plan to look into it.