diff options
| author | Giteabot <teabot@gitea.io> | 2024-05-12 10:25:55 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-05-12 10:25:55 +0800 |
| commit | 14dc00ae01c35ad51a3982a5725777bbeabe2b78 (patch) | |
| tree | 17a0d1b564c76a9bab59b6cb57c838bf2cc0b704 /routers | |
| parent | 94c5a30c8bd2ae78ffd7bd3b39bee019c531e1e7 (diff) | |
| download | gitea-14dc00ae01c35ad51a3982a5725777bbeabe2b78.tar.gz gitea-14dc00ae01c35ad51a3982a5725777bbeabe2b78.zip | |
Move reverproxyauth before session so the header will not be ignored even if user has login (#27821) (#30948)
Backport #27821 by @lunny
When a user logout and then login another user, the reverseproxy auth
should be checked before session otherwise the old user is still login.
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Diffstat (limited to 'routers')
| -rw-r--r-- | routers/web/web.go | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/routers/web/web.go b/routers/web/web.go index f3b9969059..194a67bf03 100644 --- a/routers/web/web.go +++ b/routers/web/web.go @@ -98,14 +98,14 @@ func optionsCorsHandler() func(next http.Handler) http.Handler { // The Session plugin is expected to be executed second, in order to skip authentication // for users that have already signed in. func buildAuthGroup() *auth_service.Group { - group := auth_service.NewGroup( - &auth_service.OAuth2{}, // FIXME: this should be removed and only applied in download and oauth related routers - &auth_service.Basic{}, // FIXME: this should be removed and only applied in download and git/lfs routers - &auth_service.Session{}, - ) + group := auth_service.NewGroup() + group.Add(&auth_service.OAuth2{}) // FIXME: this should be removed and only applied in download and oauth related routers + group.Add(&auth_service.Basic{}) // FIXME: this should be removed and only applied in download and git/lfs routers + if setting.Service.EnableReverseProxyAuth { - group.Add(&auth_service.ReverseProxy{}) + group.Add(&auth_service.ReverseProxy{}) // reverseproxy should before Session, otherwise the header will be ignored if user has login } + group.Add(&auth_service.Session{}) if setting.IsWindows && auth_model.IsSSPIEnabled(db.DefaultContext) { group.Add(&auth_service.SSPI{}) // it MUST be the last, see the comment of SSPI |