Fix incorrect cookie path for AppSubURL (#29534)

Regression of #24107

diff --git a/modules/setting/session.go b/modules/setting/session.go
index 8b9b754b3870257394b3716b43ee8f2bf134898f..70497e5eaa8b7509361dda5b1c8a3b24f476a20a 100644 (file)
--- a/modules/setting/session.go
+++ b/modules/setting/session.go
@@ -20,7 +20,7 @@ var SessionConfig = struct {
        ProviderConfig string
        // Cookie name to save session ID. Default is "MacaronSession".
        CookieName string
-       // Cookie path to store. Default is "/". HINT: there was a bug, the old value doesn't have trailing slash, and could be empty "".
+       // Cookie path to store. Default is "/".
        CookiePath string
        // GC interval time in seconds. Default is 3600.
        Gclifetime int64
@@ -49,7 +49,10 @@ func loadSessionFrom(rootCfg ConfigProvider) {
                fatalDuplicatedPath("session", SessionConfig.ProviderConfig)
        }
        SessionConfig.CookieName = sec.Key("COOKIE_NAME").MustString("i_like_gitea")
-       SessionConfig.CookiePath = AppSubURL + "/" // there was a bug, old code only set CookePath=AppSubURL, no trailing slash
+       SessionConfig.CookiePath = AppSubURL
+       if SessionConfig.CookiePath == "" {
+               SessionConfig.CookiePath = "/"
+       }
        SessionConfig.Secure = sec.Key("COOKIE_SECURE").MustBool(strings.HasPrefix(strings.ToLower(AppURL), "https://"))
        SessionConfig.Gclifetime = sec.Key("GC_INTERVAL_TIME").MustInt64(86400)
        SessionConfig.Maxlifetime = sec.Key("SESSION_LIFE_TIME").MustInt64(86400)

diff --git a/routers/common/middleware.go b/routers/common/middleware.go
index 1ee4c629adbc2c1e35771f79d297efb41a7caa52..c7c75fb099b468537365ceead3cdd1d8fec49fa8 100644 (file)
--- a/routers/common/middleware.go
+++ b/routers/common/middleware.go
@@ -38,6 +38,7 @@ func ProtocolMiddlewares() (handlers []any) {
                })
        })
 
+       // wrap the request and response, use the process context and add it to the process manager
        handlers = append(handlers, func(next http.Handler) http.Handler {
                return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
                        ctx, _, finished := process.GetManager().AddTypedContext(req.Context(), fmt.Sprintf("%s: %s", req.Method, req.RequestURI), process.RequestProcessType, true)