LogIn redirect on private repo? #5880

New Issue

GiteaMirror · 2025-11-02T06:39:11-06:00

GiteaMirror commented

2025-11-02 06:39:11 -06:00

Originally created by @24unix on GitHub (Aug 22, 2020).

Gitea version (or commit ref): any
Git version: any
Operating system: any
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

I've got a list of commits on a website, each have a link to the commit in Gitea.

When clicking such a link Gitea throws a 404 when it's a private repo and the user is not logged in.

Is it possible to display a 401 and the login form instead?

For my customer it looks like the Gitea is broken, when he just isn't logged in :-(

Originally created by @24unix on GitHub (Aug 22, 2020). - Gitea version (or commit ref): any - Git version: any - Operating system: any - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description I've got a list of commits on a website, each have a link to the commit in Gitea. When clicking such a link Gitea throws a 404 when it's a private repo and the user is not logged in. Is it possible to display a 401 and the login form instead? For my customer it looks like the Gitea is broken, when he just isn't logged in :-(

GiteaMirror closed this issue

2025-11-02 06:39:11 -06:00

GiteaMirror commented

2025-11-02 06:39:11 -06:00

@jolheiser commented on GitHub (Aug 22, 2020):

That was the purpose of the 404 message.

The page you are trying to reach either does not exist or you are not authorized to view it.

Giving a specific error code would allow people to potentially determine the existence of any private repo.

@jolheiser commented on GitHub (Aug 22, 2020): That was the purpose of the 404 message. `The page you are trying to reach either does not exist or you are not authorized to view it.` Giving a specific error code would allow people to potentially determine the existence of any private repo.

GiteaMirror commented

2025-11-02 06:39:12 -06:00

@lafriks commented on GitHub (Aug 22, 2020):

It would be security issue to disclose existence of private repository/user/org for unauthorized users

@lafriks commented on GitHub (Aug 22, 2020): It would be security issue to disclose existence of private repository/user/org for unauthorized users

GiteaMirror commented

2025-11-02 06:39:12 -06:00

@24unix commented on GitHub (Aug 22, 2020):

:-(

And if the decision would be up to the admin of the Gitea server?
In my case such a behaviour would be desired.

Following that argumentation a 401 is useless, as a 404 has the same effect. No access or missing page, which are two complete different things.

I found nothing for customising the error pages :-(

@24unix commented on GitHub (Aug 22, 2020): :-( And if the decision would be up to the admin of the Gitea server? In my case such a behaviour would be desired. Following that argumentation a 401 is useless, as a 404 has the same effect. No access or missing page, which are two complete different things. I found nothing for customising the error pages :-(

GiteaMirror commented

2025-11-02 06:39:12 -06:00

@zeripath commented on GitHub (Aug 23, 2020):

@24unix I wrote a pr that would make 404 a sign-in page which did not gain traction - you might want to take a look at that. I'll see if I can adjust so that although 404 would not be a login page by default it could easily be changed to one.

@zeripath commented on GitHub (Aug 23, 2020): @24unix I wrote a pr that would make 404 a sign-in page which did not gain traction - you might want to take a look at that. I'll see if I can adjust so that although 404 would not be a login page by default it could easily be changed to one.

GiteaMirror commented

2025-11-02 06:39:13 -06:00

@24unix commented on GitHub (Aug 23, 2020):

@zeripath that sound very reasonable to me.
Point is: I personally don't need to hide the existence of any user/repo/org, just of their contents.

But when my customer clicked on such a link, he thought my system was broken, not that he must be logged in to access the content.

@24unix commented on GitHub (Aug 23, 2020): @zeripath that sound very reasonable to me. Point is: I personally don't need to hide the existence of any user/repo/org, just of their contents. But when my customer clicked on such a link, he thought my system was broken, not that he must be logged in to access the content.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#5880