CORS for 'GET' attachment or assets are not working #7866

New Issue

GiteaMirror · 2025-11-02T07:39:47-06:00

GiteaMirror commented

2025-11-02 07:39:47 -06:00

Originally created by @derekhu on GitHub (Sep 20, 2021).

Gitea Version

1.15.2

Operating System

Windows

How are you running Gitea?

Localhost

Can you reproduce the bug on the Gitea demo site?

Yes

Description

CORS both for 'POST/PATCH' API and for 'GET' attachment or assets are not working

Access to XMLHttpRequest at 'http://localhost:330/attachments/b95d46d2-8fe9-4529-8bde-c5bddfe08286' from 
origin 'https://hoppscotch.io' has been blocked by CORS policy: 
Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

I am building a PWA and using REST API get access to issues and comments of self hosted Gitea. There are servial issues about CORS:

CORS works only for 'GET' method. And never set ’Access-Control-Allowed-Origin: *‘ for 'POST', 'PATCH' etc.
// after using a chrome extension 'Corss Domain', it adds the response headers ’Access-Control-Allowed-Origin: *‘ for 'POST', 'PATCH', and my PWA works.
CORS works only for REST API not for ASSETS.
As we known, CORS http method call after an 'OPTIONS' prelight request. However, 'OPTIONS’ method was not allowed for attachement assets request. It just return '405 method not allowed' while I access to the resource CORS way, using the right token.
// I have not found a Chrome extension to fix the reponse code for options access to assets yet.
// so the issue blocked.

Gitlab API provides the right response code and headers about CORS API access from different domains.

Hoping Gitea can improve the CORS implements and configration.

Screenshots

Originally created by @derekhu on GitHub (Sep 20, 2021). ### Gitea Version 1.15.2 ### Operating System Windows ### How are you running Gitea? Localhost ### Can you reproduce the bug on the Gitea demo site? Yes ### Description CORS both for 'POST/PATCH' API and for 'GET' attachment or assets are not working ```js Access to XMLHttpRequest at 'http://localhost:330/attachments/b95d46d2-8fe9-4529-8bde-c5bddfe08286' from origin 'https://hoppscotch.io' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status. ``` I am building a PWA and using REST API get access to issues and comments of self hosted Gitea. There are servial issues about CORS: 1) CORS works only for 'GET' method. And never set ’Access-Control-Allowed-Origin: *‘ for 'POST', 'PATCH' etc. // after using a chrome extension 'Corss Domain', it adds the response headers ’Access-Control-Allowed-Origin: *‘ for 'POST', 'PATCH', and my PWA works. 2) CORS works only for REST API not for ASSETS. As we known, CORS http method call after an 'OPTIONS' prelight request. However, 'OPTIONS’ method was not allowed for attachement assets request. It just return '405 method not allowed' while I access to the resource CORS way, using the right token. // I have not found a Chrome extension to fix the reponse code for options access to assets yet. // so the issue blocked. Gitlab API provides the right response code and headers about CORS API access from different domains. Hoping Gitea can improve the CORS implements and configration. ### Screenshots ![image](https://user-images.githubusercontent.com/1978211/133954996-bdfe8d1e-6391-4b1b-b09e-09965aabdf3a.png)

GiteaMirror added the type/bug label 2025-11-02 07:39:47 -06:00

GiteaMirror closed this issue

2025-11-02 07:39:47 -06:00

GiteaMirror commented

2025-11-02 07:39:48 -06:00

@noerw commented on GitHub (Oct 8, 2021):

Ad 1: Are you talking about API routes? A specific one or all? For frontend routes I'm pretty sure this is on purpose as a hardening measure.
Ad 2: that sounds like another CORS regression from the migration to chi to me

@noerw commented on GitHub (Oct 8, 2021): Ad 1: Are you talking about API routes? A specific one or all? For frontend routes I'm pretty sure this is on purpose as a hardening measure. Ad 2: that sounds like another CORS regression from the migration to chi to me

GiteaMirror commented

2025-11-02 07:39:48 -06:00

@derekhu commented on GitHub (Oct 8, 2021):

Ad 1: Are you talking about API routes? A specific one or all? For frontend routes I'm pretty sure this is on purpose as a hardening measure. Ad 2: that sounds like another CORS regression from the migration to chi to me

Not frontend routes. Some facts below:

I am using Gitea through REST API.
I call the REST API from browser, in another hosted domain, in a PWA applicaiton.
So, that is : calling gitea REST API iin another domain in browser
I am using API token for access.
CORS headers works fine for 'GET‘ (reading method) but not working for 'PATCH', 'PUT', 'DELETE' (writing method)
'GET' assets (not api call) doesn't provide CORS headers neither.

Gitlab API works fine in the same scenes ablove.

How to replay it ?

Gen an API token from Gitea profile
Use https://hoppscotch.io/
Access the Gitea REST API using the token gen in step 1)
See errors in browser.
Explain： Take hoppscotch.io as domain A, and Gitea is domain B ( localhost etc). And gitea's CORS config is on.

Thank you for reply,

@derekhu commented on GitHub (Oct 8, 2021): > Ad 1: Are you talking about API routes? A specific one or all? For frontend routes I'm pretty sure this is on purpose as a hardening measure. Ad 2: that sounds like another CORS regression from the migration to chi to me Not frontend routes. Some facts below: 1) I am using Gitea through REST API. 2) I call the REST API from browser, in another hosted domain, in a PWA applicaiton. 3) So, that is : calling gitea REST API iin another domain in browser 4) I am using API token for access. 5) CORS headers works fine for 'GET‘ (reading method) but not working for 'PATCH', 'PUT', 'DELETE' (writing method) 6) 'GET' assets (not api call) doesn't provide CORS headers neither. Gitlab API works fine in the same scenes ablove. How to replay it ? 1) Gen an API token from Gitea profile 2) Use https://hoppscotch.io/ 3) Access the Gitea REST API using the token gen in step 1) 4) See errors in browser. 5) Explain： Take hoppscotch.io as domain A, and Gitea is domain B ( localhost etc). And gitea's CORS config is on. Thank you for reply,

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#7866