basic authentication not working in 1.15.0 #7741

New Issue

GiteaMirror · 2025-11-02T07:35:03-06:00

GiteaMirror commented

2025-11-02 07:35:03 -06:00

Originally created by @dannyzcy on GitHub (Aug 24, 2021).

Gitea version: 1.15.0
Git version: 2.29.2
Operating system: windows
Database:
- PostgreSQL
- MySQL
- MSSQL
- SQLite

Description

i need to download release source zip file by CURL.

The following URL is working on 1.14.x, but not working on 1.15.0

https://{myusername}:{mypassword}@{gitea.my.host}/{org}/{repository}/archive/{tag}.zip

i'm sure ENABLE_BASIC_AUTHENTICATION is true

Thank you for your time.

Originally created by @dannyzcy on GitHub (Aug 24, 2021). - Gitea version: 1.15.0 - Git version: 2.29.2 - Operating system: windows - Database: - [ ] PostgreSQL - [x] MySQL - [ ] MSSQL - [ ] SQLite ## Description i need to download release source zip file by CURL. The following URL is working on 1.14.x, **but not working on 1.15.0** ``` https://{myusername}:{mypassword}@{gitea.my.host}/{org}/{repository}/archive/{tag}.zip ``` i'm sure ENABLE_BASIC_AUTHENTICATION is true Thank you for your time.

GiteaMirror closed this issue

2025-11-02 07:35:04 -06:00

GiteaMirror commented

2025-11-02 07:35:04 -06:00

@sthomen commented on GitHub (Sep 7, 2021):

This problem broke my docker/composer workflow with gitea when upgrading from 1.14 to 1.15. I can't even go back because of database upgrades. 😢

@sthomen commented on GitHub (Sep 7, 2021): This problem broke my docker/composer workflow with gitea when upgrading from 1.14 to 1.15. I can't even go back because of database upgrades. 😢

GiteaMirror commented

2025-11-02 07:35:04 -06:00

@zeripath commented on GitHub (Sep 7, 2021):

There are extremely good reasons for not allowing general access to the view URLs over basic authentication.

We've being adding back in exemptions in the attempt to not break users workflows but this one already has an API backend.

Have you considered using the actual API we provide?

/api/v1/repo/:owner/:repo/archive/:tag.zip

@zeripath commented on GitHub (Sep 7, 2021): There are extremely good reasons for not allowing general access to the view URLs over basic authentication. We've being adding back in exemptions in the attempt to not break users workflows but this one already has an API backend. Have you considered using the actual API we provide? /api/v1/repo/:owner/:repo/archive/:tag.zip

GiteaMirror commented

2025-11-02 07:35:05 -06:00

@sthomen commented on GitHub (Sep 7, 2021):

My code uses the zipball_url parameter provided by /api/v1/repos/:owner/:repo/tags to present it to composer, should I not have used that?

I've changed my packages server to build an URL to /api/v1/repos/:owner/:repo/archive/:tag.zip instead of zipball_url and that solved my problem. Thanks!

@sthomen commented on GitHub (Sep 7, 2021): My code uses the zipball_url parameter provided by /api/v1/repos/:owner/:repo/tags to present it to composer, should I not have used that? I've changed my packages server to build an URL to /api/v1/repos/:owner/:repo/archive/:tag.zip instead of zipball_url and that solved my problem. Thanks!

GiteaMirror commented

2025-11-02 07:35:05 -06:00

@Josue-T commented on GitHub (Sep 22, 2021):

Hello,

On my side it broke the SSO on Yunohost. As Yunohost used the Basic authentication for the SSO in the UI. Please enable it again or give an option to enable it.

Thanks

@Josue-T commented on GitHub (Sep 22, 2021): Hello, On my side it broke the SSO on Yunohost. As Yunohost used the Basic authentication for the SSO in the UI. Please enable it again or give an option to enable it. Thanks

GiteaMirror commented

2025-11-02 07:35:05 -06:00

@lunny commented on GitHub (Sep 22, 2021):

@Josue-T Could you switch to use OAuth2 auth of Gitea?

@lunny commented on GitHub (Sep 22, 2021): @Josue-T Could you switch to use OAuth2 auth of Gitea?

GiteaMirror commented

2025-11-02 07:35:05 -06:00

@zeripath commented on GitHub (Sep 22, 2021):

Please try 1.15.3

@zeripath commented on GitHub (Sep 22, 2021): Please try 1.15.3

GiteaMirror commented

2025-11-02 07:35:05 -06:00

@zeripath commented on GitHub (Sep 22, 2021):

and/or explicitly state which urls you expect to use BASIC authentication for.

@zeripath commented on GitHub (Sep 22, 2021): and/or explicitly state which urls you expect to use BASIC authentication for.

GiteaMirror commented

2025-11-02 07:35:06 -06:00

@Josue-T commented on GitHub (Sep 24, 2021):

Hello,

Thanks for your reply.

@Josue-T Could you switch to use OAuth2 auth of Gitea?

As I know OAuth2 is not natively supported on Yunohost. So it might need a lot of work to implement the support of this.

Please try 1.15.3

It still not work.

and/or explicitly state which urls you expect to use BASIC authentication for.

All urls of the view. By example /explore/repos, /user/settings, etc

@Josue-T commented on GitHub (Sep 24, 2021): Hello, Thanks for your reply. > @Josue-T Could you switch to use OAuth2 auth of Gitea? As I know OAuth2 is not natively supported on Yunohost. So it might need a lot of work to implement the support of this. > Please try 1.15.3 It still not work. > and/or explicitly state which urls you expect to use BASIC authentication for. All urls of the view. By example `/explore/repos`, `/user/settings`, etc

GiteaMirror commented

2025-11-02 07:35:06 -06:00

@zeripath commented on GitHub (Sep 24, 2021):

No. We will not allow basic authentication to access these URLs. We never should have allowed basic authentication on these - please chat with me on discord if you want/need to know more.

Your configuration is not acting like an SSO - it's forcing relogin on every request.

Does it support reverse-proxy header authentication?

I think we may need to chat to work through this. Can we discuss on discord?

@zeripath commented on GitHub (Sep 24, 2021): No. We will not allow basic authentication to access these URLs. We never should have allowed basic authentication on these - please chat with me on discord if you want/need to know more. Your configuration is not acting like an SSO - it's forcing relogin on every request. Does it support reverse-proxy header authentication? I think we may need to chat to work through this. Can we discuss on discord?

GiteaMirror commented

2025-11-02 07:35:06 -06:00

@Josue-T commented on GitHub (Sep 24, 2021):

Does it support reverse-proxy header authentication?

Yes

I think we may need to chat to work through this. Can we discuss on discord?

Well, sorry I have only Matrix or xmpp

@Josue-T commented on GitHub (Sep 24, 2021): > Does it support reverse-proxy header authentication? Yes > I think we may need to chat to work through this. Can we discuss on discord? Well, sorry I have only Matrix or xmpp

GiteaMirror commented

2025-11-02 07:35:06 -06:00

@zeripath commented on GitHub (Sep 24, 2021):

Does it support reverse-proxy header authentication?

Yes

Then use that!

I think we may need to chat to work through this. Can we discuss on discord?

Well, sorry I have only Matrix or xmpp

Er... you know discord is just a webapp - however, you can contact me as zeripath on matrix too.

@zeripath commented on GitHub (Sep 24, 2021): > > Does it support reverse-proxy header authentication? > > Yes Then use that! > > I think we may need to chat to work through this. Can we discuss on discord? > > Well, sorry I have only Matrix or xmpp Er... you know discord is just a webapp - however, you can contact me as zeripath on matrix too.

GiteaMirror commented

2025-11-02 07:35:07 -06:00

@Josue-T commented on GitHub (Dec 12, 2021):

Hello,
Thanks you very much for your help.

I've tried the configuration suggest me but it still don't work. I use this configuration for nginx:

https://github.com/YunoHost-Apps/gitea_ynh/blob/testing/conf/nginx.conf

And this configuration for gitea:

https://github.com/YunoHost-Apps/gitea_ynh/blob/testing/conf/app.ini

Any idea ?

@Josue-T commented on GitHub (Dec 12, 2021): Hello, Thanks you very much for your help. I've tried the configuration suggest me but it still don't work. I use this configuration for nginx: https://github.com/YunoHost-Apps/gitea_ynh/blob/testing/conf/nginx.conf And this configuration for gitea: https://github.com/YunoHost-Apps/gitea_ynh/blob/testing/conf/app.ini Any idea ?

GiteaMirror commented

2025-11-02 07:35:07 -06:00

@wxiaoguang commented on GitHub (Mar 30, 2022):

the code base has changed a lot

if it is still a problem on 1.16 (or 1.17-dev), feel free to reopen.

@wxiaoguang commented on GitHub (Mar 30, 2022): the code base has changed a lot if it is still a problem on 1.16 (or 1.17-dev), feel free to reopen.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#7741