Matrix webhook doesn't send access token in Authorization header on replay #9021

New Issue

GiteaMirror · 2025-11-02T08:26:13-06:00

GiteaMirror commented

2025-11-02 08:26:13 -06:00

Originally created by @jellykells on GitHub (Jun 2, 2022).

Description

If a Matrix webhook fails and it is replayed, the access token is not sent in the Authorization header. The resulting header sent is Authorization: Bearer

Gitea Version

1.16.8

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

https://gist.github.com/jellykells/68fdaba33b2a68c2a3edec59a34b5b40

Screenshots

No response

Git Version

2.17.1

Operating System

Linux 4.15.0

How are you running Gitea?

Binary downloaded from GitHub and run with systemd

Database

MySQL

Originally created by @jellykells on GitHub (Jun 2, 2022). ### Description If a Matrix webhook fails and it is replayed, the access token is not sent in the Authorization header. The resulting header sent is `Authorization: Bearer` ### Gitea Version 1.16.8 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist https://gist.github.com/jellykells/68fdaba33b2a68c2a3edec59a34b5b40 ### Screenshots _No response_ ### Git Version 2.17.1 ### Operating System Linux 4.15.0 ### How are you running Gitea? Binary downloaded from GitHub and run with systemd ### Database MySQL

GiteaMirror added the type/bug label 2025-11-02 08:26:13 -06:00

GiteaMirror closed this issue

2025-11-02 08:26:13 -06:00

GiteaMirror commented

2025-11-02 08:26:14 -06:00

@oliverpool commented on GitHub (Jul 7, 2022):

From a quick analysis, here is what I think happens:

the original (insecure) payload is generated, with the access_token and saved as HookTask
on first try, the HookTask is fetch from the database and the access_token is taken from the payload and the payload is replaced with a safe payload (without the token):
https://github.com/go-gitea/gitea/blob/release/v1.17/services/webhook/matrix.go#L267-L277
after every try the HookTask is saved
https://github.com/go-gitea/gitea/blob/release/v1.17/services/webhook/deliver.go#L158
hence on retry, the payload does not contain the token anymore

There is a PR to better manage such Authorization header, which should fix this: https://github.com/go-gitea/gitea/pull/20267 (the PR is initially aimed only for gitea webhooks, but I hope that it will be reconsidered :)

@oliverpool commented on GitHub (Jul 7, 2022): From a quick analysis, here is what I think happens: - the original (insecure) payload is generated, with the `access_token` and saved as `HookTask` - on first try, the `HookTask` is fetch from the database and the `access_token` is taken from the payload and the payload is replaced with a *safe* payload (without the token): https://github.com/go-gitea/gitea/blob/release/v1.17/services/webhook/matrix.go#L267-L277 - after every try the `HookTask` is saved https://github.com/go-gitea/gitea/blob/release/v1.17/services/webhook/deliver.go#L158 - hence on retry, the payload does not contain the token anymore There is a PR to better manage such Authorization header, which should fix this: https://github.com/go-gitea/gitea/pull/20267 (the PR is initially aimed only for gitea webhooks, but I hope that it will be reconsidered :)

GiteaMirror commented

2025-11-02 08:26:14 -06:00

@oliverpool commented on GitHub (Nov 7, 2022):

FYI, the PR should be included in the 1.19 release (in a couple of months).

@oliverpool commented on GitHub (Nov 7, 2022): FYI, the PR should be included in the 1.19 release (in a couple of months).

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9021