Can't login when use http://IP:port

[MattMaBX]

Description

I have edited the config of ROOT_URL to my domain, because I have to visit the website out of LAN by frp.
But I can't login when use http://IP:port. When I click login, I will be redirected to home page.

2024-02-27.21.40.23.mov

And if I visit my gitea by my domain, it will be fine.

default.mov

That's my app.ini:

Gitea Version

1.21.6

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

No response

Operating System

Ubuntu 22.04

How are you running Gitea?

Docker

Database

SQLite

[lunny]

Please confirm you can visit it normally from your LAN. Otherwise, find the problem of your FRP configuration.

[MattMaBX]

Please confirm you can visit it normally from your LAN. Otherwise, find the problem of your FRP configuration.

Thanks for the reply!
I confirmed that I can visit it from LAN normally, and also, I can clone my projects by both http://172.22.66.88:3000/Matt/xxxx and [email protected]:22/Matt/xxxx in my LAN.
Besides, I find that if I change the ROOT_URL to my IP address, I will be able to log in normally, but I need to set ROOT_URL to my domain name to ensure normal access out of LAN. That's the problem.

[yp05327]

Can you provide some details about the login post request in network tab?

[charles7668]

I tested this issue. When the ROOT_URL is configured to use HTTPS, logging in using HTTP will redirect to the home page, rather than the IP:port. However, using HTTP for the ROOT_URL works fine.

[yp05327]

By my test, if login success, it will always redirect to "/", so no matter what ROOT_URL is, it should redirect to the correct URL.

[charles7668]

By my test, if login success, it will always redirect to "/", so no matter what ROOT_URL is, it should redirect to the correct URL.

I believe this problem is related to PR #26999. When loading a page using HTTP, the browser detects that the cookie is secure and prevents the addition of other cookies. As a result, Gitea cannot verify the login information.

Therefore, this may not be a bug, as this security feature is provided by the browser.

[MattMaBX]

I tested this issue. When the ROOT_URL is configured to use HTTPS, logging in using HTTP will redirect to the home page, rather than the IP:port. However, using HTTP for the ROOT_URL works fine.

Wow, that's worked. When I set the ROOT_URL without HTTPS, that will be fine! But I don't know if there is a BUG or that's just a normal feature.
Anyway, this setting solved my problem. Thanks.

[MattMaBX]

Can you provide some details about the login post request in network tab?

Sure.


Is it enough?

[GiteaBot]

We close issues that need feedback from the author if there were no new comments for a month. 🍵

[wxiaoguang]

"Unable to login" usually means some cookie problems (>99% cases)

For example, using "https" means "https-only cookie", then it doesn't work with http (config option: COOKIE_SECURE)