Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

public resources should not set redirect_to cookie #11088

Closed
silverwind opened this issue Apr 16, 2020 · 2 comments · Fixed by #11117
Closed

public resources should not set redirect_to cookie #11088

silverwind opened this issue Apr 16, 2020 · 2 comments · Fixed by #11117
Labels
type/bug

Comments

@silverwind
Copy link
Member

silverwind commented Apr 16, 2020 •
edited
Loading

/js/userheatmap.js is currently requested by the serviceworker which is a bug in itself but the request causes a bad cookie to be set when authentication is enabled:

Request URL: /js/userheatmap.js
Request Method: GET

status: 302
location: /user/login
set-cookie: redirect_to=%2Fjs%2Fuserheatmap.js; Path=/

The next time the user logs in with that cookie set, they will be redirected to /js/userheatmap.js which causes a page loading error. We should just 404 any requests that would be routed to a file in public, or at least the js/css/img/vendor folders.
@silverwind silverwind changed the title Non-existant public resources should not redirect to /user/login Non-existant public resources should not cause redirect_to cookie to be set Apr 16, 2020
@silverwind silverwind changed the title Non-existant public resources should not cause redirect_to cookie to be set public resources should not cause redirect_to cookie to be set Apr 16, 2020
@silverwind silverwind changed the title public resources should not cause redirect_to cookie to be set public resources should not set redirect_to cookie Apr 16, 2020
silverwind added a commit to silverwind/gitea that referenced this issue Apr 16, 2020
@silverwind
Remove nonexistant serviceworker entries
87f2712 
Workaround for go-gitea#11088, was
introduced in
go-gitea@561e7a9.
@silverwind silverwind mentioned this issue Apr 16, 2020
Merged
@guillep2k
Copy link
Member

Fixed in #11091

@silverwind
Copy link
Member Author

No, not fixed, it's just a workaround. Proper fix will be in the router, I plan to look into it.

@lafriks lafriks reopened this Apr 17, 2020
@silverwind silverwind mentioned this issue Apr 17, 2020
Merged
silverwind added a commit to silverwind/gitea that referenced this issue Apr 17, 2020
@silverwind
Send 404 immediately for known public requests
55d922e 
Instead of further handling requests to `public` which causes issues
like go-gitea#11088, immediately
terminate requests to directories `js`, `css`, `fomantic` if no file is
found which is checked against a hardcoded list. Maybe there is a way to
retrieve the top-level entries below `public` in a dynamic fashion.

I also added `fomantic` to the reserved usernames and sorted the list.

Fixes: go-gitea#11088
zeripath pushed a commit that referenced this issue Apr 18, 2020
@silverwind
Send 404 immediately for known public requests (#11117)
5180deb 
Instead of further handling requests to public which causes issues like #11088, immediately terminate requests to directories js, css, fomantic if no file is found which is checked against a hardcoded list. Maybe there is a way to retrieve the top-level entries below public in a dynamic fashion.

I also added fomantic to the reserved usernames and sorted the list.

Fixes: #11088
ydelafollye pushed a commit to ydelafollye/gitea that referenced this issue Jul 31, 2020
@silverwind
Send 404 immediately for known public requests (go-gitea#11117)
9557588 
Instead of further handling requests to public which causes issues like go-gitea#11088, immediately terminate requests to directories js, css, fomantic if no file is found which is checked against a hardcoded list. Maybe there is a way to retrieve the top-level entries below public in a dynamic fashion.

I also added fomantic to the reserved usernames and sorted the list.

Fixes: go-gitea#11088
@go-gitea go-gitea locked and limited conversation to collaborators Nov 24, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
type/bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Send 404 immediately for known public requests silverwind/gitea
3 participants
@silverwind @lafriks @guillep2k