CORS on git smart http protocol can not work on main branch #7547

New Issue

GiteaMirror · 2025-11-02T07:29:25-06:00

GiteaMirror commented

2025-11-02 07:29:25 -06:00

Originally created by @snowyu on GitHub (Jul 6, 2021).

Gitea version (or commit ref): 27c1578235
Git version: 2.25.1

Operating system:

Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.2 LTS
Release:	20.04
Codename:	focal

Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
Log gist:

Description

This feature #5719(#5700) can not work now.

The browser say:

Access to XMLHttpRequest at 'http://localhost:3000/name/repo.git/info/refs?service=git-upload-pack' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

And the response header has nothing CORS header return.

The server report:

Completed OPTIONS /name/repo.git/info/refs?service=git-upload-pack 405 Method Not Allowed in 780.91µs

I've found it was incorrectly rejected before entering httpBase.

27c1578235/routers/web/web.go (L150)

The context.Contexter() reject it.

Just add the following code before context.Contexter() to fix:

	common = append(common, CorsHandler) // added here
	// Removed: toolbox.Toolboxer middleware will provide debug informations which seems unnecessary
	common = append(common, context.Contexter())

Originally created by @snowyu on GitHub (Jul 6, 2021).   - Gitea version (or commit ref): 27c15782352aabaf9279c9c187d3658649d81e2f - Git version: 2.25.1 - Operating system: ``` Distributor ID: Ubuntu Description: Ubuntu 20.04.2 LTS Release: 20.04 Codename: focal ```    - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - Log gist:    ## Description This feature #5719(#5700) can not work now. The browser say: ``` Access to XMLHttpRequest at 'http://localhost:3000/name/repo.git/info/refs?service=git-upload-pack' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. ``` And the response header has nothing CORS header return. The server report: ``` Completed OPTIONS /name/repo.git/info/refs?service=git-upload-pack 405 Method Not Allowed in 780.91µs ``` I've found it was incorrectly rejected before entering httpBase. https://github.com/go-gitea/gitea/blob/27c15782352aabaf9279c9c187d3658649d81e2f/routers/web/web.go#L150 The `context.Contexter()` reject it. Just add the following code before `context.Contexter()` to fix: ```go common = append(common, CorsHandler) // added here // Removed: toolbox.Toolboxer middleware will provide debug informations which seems unnecessary common = append(common, context.Contexter()) ```

GiteaMirror added the type/bug label 2025-11-02 07:29:25 -06:00

GiteaMirror closed this issue

2025-11-02 07:29:25 -06:00

GiteaMirror commented

2025-11-02 07:29:26 -06:00

@snowyu commented on GitHub (Jul 6, 2021):

It seems that the new [cors] configuration section will replace the old ACCESS_CONTROL_ALLOW_ORIGIN config.

@snowyu commented on GitHub (Jul 6, 2021): It seems that the new `[cors]` configuration section will replace the old `ACCESS_CONTROL_ALLOW_ORIGIN` config.

GiteaMirror commented

2025-11-02 07:29:27 -06:00

@noerw commented on GitHub (Jul 10, 2021):

So it works after you updated your config? In that case, please close this issue :)

Maybe related: #16100

@noerw commented on GitHub (Jul 10, 2021): So it works after you updated your config? In that case, please close this issue :) Maybe related: #16100

GiteaMirror commented

2025-11-02 07:29:27 -06:00

@snowyu commented on GitHub (Jul 10, 2021):

No，It will only work after modifying the above code.

If you have read the source code, you will find the feature of cors is the same as the ACCESS_CONTROL_ALLOW_ORIGIN config.

So I think you can deprecate the old ACCESS_CONTROL_ALLOW_ORIGIN.

@snowyu commented on GitHub (Jul 10, 2021): No，It will only work after modifying the above code. If you have read the source code, you will find the feature of `cors` is the same as the ACCESS_CONTROL_ALLOW_ORIGIN config. So I think you can deprecate the old ACCESS_CONTROL_ALLOW_ORIGIN.

GiteaMirror commented

2025-11-02 07:29:27 -06:00

@snowyu commented on GitHub (Jul 10, 2021):

Enh, Maybe My changes can fix the #16100.

@snowyu commented on GitHub (Jul 10, 2021): Enh, Maybe My changes can fix the #16100.

GiteaMirror commented

2025-11-02 07:29:27 -06:00

@lunny commented on GitHub (Jul 18, 2021):

Could you send a PR to fix that? I'm thinking we may should use different cors settings for smart http, api and others.

@lunny commented on GitHub (Jul 18, 2021): Could you send a PR to fix that? I'm thinking we may should use different cors settings for smart http, api and others.

GiteaMirror commented

2025-11-02 07:29:27 -06:00

@snowyu commented on GitHub (Jul 20, 2021):

Ok. I've added support for CORS on most repo operations. But I have no idea how to wtite an unit test.

@snowyu commented on GitHub (Jul 20, 2021): Ok. I've added support for CORS on most repo operations. But I have no idea how to wtite an unit test.

GiteaMirror commented

2025-11-02 07:29:28 -06:00

@zeripath commented on GitHub (Jul 20, 2021):

In order to provide a test it would be helpful if you could simply list the requests that lightning git would make over the smart protocol - then you would simply write a test that ensures that the appropriate headers are sent back.

Another option is to point to the smart git protocol documentation here.

@zeripath commented on GitHub (Jul 20, 2021): In order to provide a test it would be helpful if you could simply list the requests that lightning git would make over the smart protocol - then you would simply write a test that ensures that the appropriate headers are sent back. Another option is to point to the smart git protocol documentation here.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#7547