Skip to content

Commit c9cd3bf

Browse files
silverwindsilverwind
committed
Automatically set cookie secure attribute, remove COOKIE_SECURE option
1 parent e596806 commit c9cd3bf

File tree

20 files changed

+72
-68
lines changed

20 files changed

+72
-68
lines changed

‎custom/conf/app.example.ini

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1744,9 +1744,6 @@ LEVEL = Info
17441744
;; Session cookie name
17451745
;COOKIE_NAME = i_like_gitea
17461746
;;
1747-
;; If you use session in https only, default is false
1748-
;COOKIE_SECURE = false
1749-
;;
17501747
;; Session GC time interval in seconds, default is 86400 (1 day)
17511748
;GC_INTERVAL_TIME = 86400
17521749
;;

‎docs/content/administration/config-cheat-sheet.en-us.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -776,7 +776,6 @@ and
776776

777777
- `PROVIDER`: **memory**: Session engine provider \[memory, file, redis, redis-cluster, db, mysql, couchbase, memcache, postgres\]. Setting `db` will reuse the configuration in `[database]`
778778
- `PROVIDER_CONFIG`: **data/sessions**: For file, the root path; for db, empty (database config will be used); for others, the connection string. Relative paths will be made absolute against _`AppWorkPath`_.
779-
- `COOKIE_SECURE`: **false**: Enable this to force using HTTPS for all session access.
780779
- `COOKIE_NAME`: **i\_like\_gitea**: The name of the cookie used for the session ID.
781780
- `GC_INTERVAL_TIME`: **86400**: GC interval in seconds.
782781
- `SESSION_LIFE_TIME`: **86400**: Session life time in seconds, default is 86400 (1 day)

‎docs/content/administration/config-cheat-sheet.zh-cn.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -742,7 +742,6 @@ Gitea 创建以下非唯一队列：
742742

743743
- `PROVIDER`: **memory**：会话存储引擎 \[memory, file, redis, redis-cluster, db, mysql, couchbase, memcache, postgres\]。设置为 `db` 将会重用 `[database]` 的配置信息。
744744
- `PROVIDER_CONFIG`: **data/sessions**：对于文件，为根路径；对于 db，为空（将使用数据库配置）；对于其他引擎，为连接字符串。相对路径将根据 _`AppWorkPath`_ 绝对化。
745-
- `COOKIE_SECURE`: **false**：启用此选项以强制在所有会话访问中使用 HTTPS。
746745
- `COOKIE_NAME`: **i\_like\_gitea**：用于会话 ID 的 cookie 名称。
747746
- `GC_INTERVAL_TIME`: **86400**：GC 间隔时间，以秒为单位。
748747
- `SESSION_LIFE_TIME`: **86400**：会话生命周期，以秒为单位，默认为 86400（1 天）。

‎modules/context/context.go

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -133,17 +133,6 @@ func NewWebContext(base *Base, render Render, session session.Store) *Context {
133133
// Contexter initializes a classic context for a request.
134134
func Contexter() func(next http.Handler) http.Handler {
135135
rnd := templates.HTMLRenderer()
136-
csrfOpts := CsrfOptions{
137-
Secret: setting.SecretKey,
138-
Cookie: setting.CSRFCookieName,
139-
SetCookie: true,
140-
Secure: setting.SessionConfig.Secure,
141-
CookieHTTPOnly: setting.CSRFCookieHTTPOnly,
142-
Header: "X-Csrf-Token",
143-
CookieDomain: setting.SessionConfig.Domain,
144-
CookiePath: setting.SessionConfig.CookiePath,
145-
SameSite: setting.SessionConfig.SameSite,
146-
}
147136
if !setting.IsProd {
148137
CsrfTokenRegenerationInterval = 5 * time.Second // in dev, re-generate the tokens more aggressively for debug purpose
149138
}
@@ -166,6 +155,17 @@ func Contexter() func(next http.Handler) http.Handler {
166155
ctx.Base.AppendContextValue(WebContextKey, ctx)
167156
ctx.Base.AppendContextValueFunc(git.RepositoryContextKey, func() any { return ctx.Repo.GitRepo })
168157

158+
csrfOpts := CsrfOptions{
159+
Secret: setting.SecretKey,
160+
Cookie: setting.CSRFCookieName,
161+
SetCookie: true,
162+
Secure: middleware.GetCookieSecure(ctx.Req),
163+
Header: "X-Csrf-Token",
164+
CookieDomain: setting.SessionConfig.Domain,
165+
CookiePath: setting.SessionConfig.CookiePath,
166+
CookieHTTPOnly: setting.CSRFCookieHTTPOnly,
167+
SameSite: setting.SessionConfig.SameSite,
168+
}
169169
ctx.Csrf = PrepareCSRFProtector(csrfOpts, ctx)
170170

171171
// Get the last flash message from cookie
@@ -185,9 +185,9 @@ func Contexter() func(next http.Handler) http.Handler {
185185
// if there are new messages in the ctx.Flash, write them into cookie
186186
ctx.Resp.Before(func(resp ResponseWriter) {
187187
if val := ctx.Flash.Encode(); val != "" {
188-
middleware.SetSiteCookie(ctx.Resp, CookieNameFlash, val, 0)
188+
middleware.SetSiteCookie(ctx.Resp, ctx.Req, CookieNameFlash, val, 0)
189189
} else if lastFlashCookie != "" {
190-
middleware.SetSiteCookie(ctx.Resp, CookieNameFlash, "", -1)
190+
middleware.SetSiteCookie(ctx.Resp, ctx.Req, CookieNameFlash, "", -1)
191191
}
192192
})
193193

‎modules/context/context_cookie.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,13 @@ func removeSessionCookieHeader(w http.ResponseWriter) {
3232
// SetSiteCookie convenience function to set most cookies consistently
3333
// CSRF and a few others are the exception here
3434
func (ctx *Context) SetSiteCookie(name, value string, maxAge int) {
35-
middleware.SetSiteCookie(ctx.Resp, name, value, maxAge)
35+
middleware.SetSiteCookie(ctx.Resp, ctx.Req, name, value, maxAge)
3636
}
3737

3838
// DeleteSiteCookie convenience function to delete most cookies consistently
3939
// CSRF and a few others are the exception here
4040
func (ctx *Context) DeleteSiteCookie(name string) {
41-
middleware.SetSiteCookie(ctx.Resp, name, "", -1)
41+
middleware.SetSiteCookie(ctx.Resp, ctx.Req, name, "", -1)
4242
}
4343

4444
// GetSiteCookie returns given cookie value from request header.

‎modules/setting/session.go

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@ var SessionConfig = struct {
2727
Gclifetime int64
2828
// Max life time in seconds. Default is whatever GC interval time is.
2929
Maxlifetime int64
30-
// Use HTTPS only. Default is false.
31-
Secure bool
3230
// Cookie domain name. Default is empty.
3331
Domain string
3432
// SameSite declares if your cookie should be restricted to a first-party or same-site context. Valid strings are "none", "lax", "strict". Default is "lax"
@@ -50,7 +48,6 @@ func loadSessionFrom(rootCfg ConfigProvider) {
5048
}
5149
SessionConfig.CookieName = sec.Key("COOKIE_NAME").MustString("i_like_gitea")
5250
SessionConfig.CookiePath = AppSubURL + "/" // there was a bug, old code only set CookePath=AppSubURL, no trailing slash
53-
SessionConfig.Secure = sec.Key("COOKIE_SECURE").MustBool(false)
5451
SessionConfig.Gclifetime = sec.Key("GC_INTERVAL_TIME").MustInt64(86400)
5552
SessionConfig.Maxlifetime = sec.Key("SESSION_LIFE_TIME").MustInt64(86400)
5653
SessionConfig.Domain = sec.Key("DOMAIN").String()

‎modules/web/middleware/cookie.go

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ import (
1313
)
1414

1515
// SetRedirectToCookie convenience function to set the RedirectTo cookie consistently
16-
func SetRedirectToCookie(resp http.ResponseWriter, value string) {
17-
SetSiteCookie(resp, "redirect_to", value, 0)
16+
func SetRedirectToCookie(resp http.ResponseWriter, req *http.Request, value string) {
17+
SetSiteCookie(resp, req, "redirect_to", value, 0)
1818
}
1919

2020
// DeleteRedirectToCookie convenience function to delete most cookies consistently
21-
func DeleteRedirectToCookie(resp http.ResponseWriter) {
22-
SetSiteCookie(resp, "redirect_to", "", -1)
21+
func DeleteRedirectToCookie(resp http.ResponseWriter, req *http.Request) {
22+
SetSiteCookie(resp, req, "redirect_to", "", -1)
2323
}
2424

2525
// GetSiteCookie returns given cookie value from request header.
@@ -32,15 +32,26 @@ func GetSiteCookie(req *http.Request, name string) string {
3232
return val
3333
}
3434

35+
// GetCookieSecure returns whether the "Secure" attribute on a cookie should be set
36+
func GetCookieSecure(req *http.Request) bool {
37+
forwardedProto := req.Header.Get("x-forwarded-proto")
38+
if forwardedProto != "" {
39+
return forwardedProto == "https"
40+
} else {
41+
return req.TLS != nil
42+
}
43+
}
44+
3545
// SetSiteCookie returns given cookie value from request header.
36-
func SetSiteCookie(resp http.ResponseWriter, name, value string, maxAge int) {
46+
func SetSiteCookie(resp http.ResponseWriter, req *http.Request, name, value string, maxAge int) {
47+
3748
cookie := &http.Cookie{
3849
Name: name,
3950
Value: url.QueryEscape(value),
4051
MaxAge: maxAge,
4152
Path: setting.SessionConfig.CookiePath,
4253
Domain: setting.SessionConfig.Domain,
43-
Secure: setting.SessionConfig.Secure,
54+
Secure: GetCookieSecure(req),
4455
HttpOnly: true,
4556
SameSite: setting.SessionConfig.SameSite,
4657
}

‎modules/web/middleware/locale.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,19 +41,19 @@ func Locale(resp http.ResponseWriter, req *http.Request) translation.Locale {
4141
}
4242

4343
if changeLang {
44-
SetLocaleCookie(resp, lang, 1<<31-1)
44+
SetLocaleCookie(resp, req, lang, 1<<31-1)
4545
}
4646

4747
return translation.NewLocale(lang)
4848
}
4949

5050
// SetLocaleCookie convenience function to set the locale cookie consistently
51-
func SetLocaleCookie(resp http.ResponseWriter, lang string, maxAge int) {
52-
SetSiteCookie(resp, "lang", lang, maxAge)
51+
func SetLocaleCookie(resp http.ResponseWriter, req *http.Request, lang string, maxAge int) {
52+
SetSiteCookie(resp, req, "lang", lang, maxAge)
5353
}
5454

5555
// DeleteLocaleCookie convenience function to delete the locale cookie consistently
5656
// Setting the lang cookie will trigger the middleware to reset the language to previous state.
57-
func DeleteLocaleCookie(resp http.ResponseWriter) {
58-
SetSiteCookie(resp, "lang", "", -1)
57+
func DeleteLocaleCookie(resp http.ResponseWriter, req *http.Request) {
58+
SetSiteCookie(resp, req, "lang", "", -1)
5959
}

‎options/locale/locale_en-US.ini

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3109,7 +3109,6 @@ config.provider_config = Provider Config
31093109
config.cookie_name = Cookie Name
31103110
config.gc_interval_time = GC Interval Time
31113111
config.session_life_time = Session Life Time
3112-
config.https_only = HTTPS Only
31133112
config.cookie_life_time = Cookie Life Time
31143113

31153114
config.picture_config = Picture and Avatar Configuration

‎routers/common/middleware.go

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -101,15 +101,20 @@ func stripSlashesMiddleware(next http.Handler) http.Handler {
101101
}
102102

103103
func Sessioner() func(next http.Handler) http.Handler {
104-
return session.Sessioner(session.Options{
105-
Provider: setting.SessionConfig.Provider,
106-
ProviderConfig: setting.SessionConfig.ProviderConfig,
107-
CookieName: setting.SessionConfig.CookieName,
108-
CookiePath: setting.SessionConfig.CookiePath,
109-
Gclifetime: setting.SessionConfig.Gclifetime,
110-
Maxlifetime: setting.SessionConfig.Maxlifetime,
111-
Secure: setting.SessionConfig.Secure,
112-
SameSite: setting.SessionConfig.SameSite,
113-
Domain: setting.SessionConfig.Domain,
114-
})
104+
return func(next http.Handler) http.Handler {
105+
return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
106+
handler := session.Sessioner(session.Options{
107+
Provider: setting.SessionConfig.Provider,
108+
ProviderConfig: setting.SessionConfig.ProviderConfig,
109+
CookieName: setting.SessionConfig.CookieName,
110+
CookiePath: setting.SessionConfig.CookiePath,
111+
Gclifetime: setting.SessionConfig.Gclifetime,
112+
Maxlifetime: setting.SessionConfig.Maxlifetime,
113+
Secure: middleware.GetCookieSecure(req),
114+
SameSite: setting.SessionConfig.SameSite,
115+
Domain: setting.SessionConfig.Domain,
116+
})
117+
handler.ServeHTTP(resp, req) // handler.ServeHTTP undefined
118+
})
119+
}
115120
}

‎routers/web/admin/config.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,6 @@ func Config(ctx *context.Context) {
159159
sessionCfg.CookiePath = realSession.CookiePath
160160
sessionCfg.Gclifetime = realSession.Gclifetime
161161
sessionCfg.Maxlifetime = realSession.Maxlifetime
162-
sessionCfg.Secure = realSession.Secure
163162
sessionCfg.Domain = realSession.Domain
164163
}
165164
sessionCfg.ProviderConfig = shadowPassword(sessionCfg.Provider, sessionCfg.ProviderConfig)

‎routers/web/auth/auth.go

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ func resetLocale(ctx *context.Context, u *user_model.User) error {
104104
}
105105
}
106106

107-
middleware.SetLocaleCookie(ctx.Resp, u.Language, 0)
107+
middleware.SetLocaleCookie(ctx.Resp, ctx.Req, u.Language, 0)
108108

109109
if ctx.Locale.Language() != u.Language {
110110
ctx.Locale = middleware.Locale(ctx.Resp, ctx.Req)
@@ -123,13 +123,13 @@ func checkAutoLogin(ctx *context.Context) bool {
123123

124124
redirectTo := ctx.FormString("redirect_to")
125125
if len(redirectTo) > 0 {
126-
middleware.SetRedirectToCookie(ctx.Resp, redirectTo)
126+
middleware.SetRedirectToCookie(ctx.Resp, ctx.Req, redirectTo)
127127
} else {
128128
redirectTo = ctx.GetSiteCookie("redirect_to")
129129
}
130130

131131
if isSucceed {
132-
middleware.DeleteRedirectToCookie(ctx.Resp)
132+
middleware.DeleteRedirectToCookie(ctx.Resp, ctx.Req)
133133
ctx.RedirectToFirst(redirectTo, setting.AppSubURL+string(setting.LandingPageURL))
134134
return true
135135
}
@@ -323,7 +323,7 @@ func handleSignInFull(ctx *context.Context, u *user_model.User, remember, obeyRe
323323
}
324324
}
325325

326-
middleware.SetLocaleCookie(ctx.Resp, u.Language, 0)
326+
middleware.SetLocaleCookie(ctx.Resp, ctx.Req, u.Language, 0)
327327

328328
if ctx.Locale.Language() != u.Language {
329329
ctx.Locale = middleware.Locale(ctx.Resp, ctx.Req)
@@ -340,7 +340,7 @@ func handleSignInFull(ctx *context.Context, u *user_model.User, remember, obeyRe
340340
}
341341

342342
if redirectTo := ctx.GetSiteCookie("redirect_to"); len(redirectTo) > 0 && !utils.IsExternalURL(redirectTo) {
343-
middleware.DeleteRedirectToCookie(ctx.Resp)
343+
middleware.DeleteRedirectToCookie(ctx.Resp, ctx.Req)
344344
if obeyRedirect {
345345
ctx.RedirectToFirst(redirectTo)
346346
}
@@ -371,7 +371,7 @@ func HandleSignOut(ctx *context.Context) {
371371
ctx.DeleteSiteCookie(setting.CookieUserName)
372372
ctx.DeleteSiteCookie(setting.CookieRememberName)
373373
ctx.Csrf.DeleteCookie(ctx)
374-
middleware.DeleteRedirectToCookie(ctx.Resp)
374+
middleware.DeleteRedirectToCookie(ctx.Resp, ctx.Req)
375375
}
376376

377377
// SignOut sign out from login status
@@ -400,7 +400,7 @@ func SignUp(ctx *context.Context) {
400400

401401
redirectTo := ctx.FormString("redirect_to")
402402
if len(redirectTo) > 0 {
403-
middleware.SetRedirectToCookie(ctx.Resp, redirectTo)
403+
middleware.SetRedirectToCookie(ctx.Resp, ctx.Req, redirectTo)
404404
}
405405

406406
ctx.HTML(http.StatusOK, tplSignUp)
@@ -735,7 +735,7 @@ func handleAccountActivation(ctx *context.Context, user *user_model.User) {
735735

736736
ctx.Flash.Success(ctx.Tr("auth.account_activated"))
737737
if redirectTo := ctx.GetSiteCookie("redirect_to"); len(redirectTo) > 0 {
738-
middleware.DeleteRedirectToCookie(ctx.Resp)
738+
middleware.DeleteRedirectToCookie(ctx.Resp, ctx.Req)
739739
ctx.RedirectToFirst(redirectTo)
740740
return
741741
}

‎routers/web/auth/oauth.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -855,7 +855,7 @@ func SignInOAuth(ctx *context.Context) {
855855

856856
redirectTo := ctx.FormString("redirect_to")
857857
if len(redirectTo) > 0 {
858-
middleware.SetRedirectToCookie(ctx.Resp, redirectTo)
858+
middleware.SetRedirectToCookie(ctx.Resp, ctx.Req, redirectTo)
859859
}
860860

861861
// try to do a direct callback flow, so we don't authenticate the user again but use the valid accesstoken to get the user
@@ -1163,7 +1163,7 @@ func handleOAuth2SignIn(ctx *context.Context, source *auth.Source, u *user_model
11631163
}
11641164

11651165
if redirectTo := ctx.GetSiteCookie("redirect_to"); len(redirectTo) > 0 {
1166-
middleware.DeleteRedirectToCookie(ctx.Resp)
1166+
middleware.DeleteRedirectToCookie(ctx.Resp, ctx.Req)
11671167
ctx.RedirectToFirst(redirectTo)
11681168
return
11691169
}

‎routers/web/auth/openid.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,13 @@ func SignInOpenID(ctx *context.Context) {
4545

4646
redirectTo := ctx.FormString("redirect_to")
4747
if len(redirectTo) > 0 {
48-
middleware.SetRedirectToCookie(ctx.Resp, redirectTo)
48+
middleware.SetRedirectToCookie(ctx.Resp, ctx.Req, redirectTo)
4949
} else {
5050
redirectTo = ctx.GetSiteCookie("redirect_to")
5151
}
5252

5353
if isSucceed {
54-
middleware.DeleteRedirectToCookie(ctx.Resp)
54+
middleware.DeleteRedirectToCookie(ctx.Resp, ctx.Req)
5555
ctx.RedirectToFirst(redirectTo)
5656
return
5757
}

‎routers/web/auth/password.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -338,7 +338,7 @@ func MustChangePasswordPost(ctx *context.Context) {
338338
log.Trace("User updated password: %s", u.Name)
339339

340340
if redirectTo := ctx.GetSiteCookie("redirect_to"); len(redirectTo) > 0 && !utils.IsExternalURL(redirectTo) {
341-
middleware.DeleteRedirectToCookie(ctx.Resp)
341+
middleware.DeleteRedirectToCookie(ctx.Resp, ctx.Req)
342342
ctx.RedirectToFirst(redirectTo)
343343
return
344344
}

‎routers/web/home.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ func Home(ctx *context.Context) {
4141
} else if ctx.Doer.MustChangePassword {
4242
ctx.Data["Title"] = ctx.Tr("auth.must_change_password")
4343
ctx.Data["ChangePasscodeLink"] = setting.AppSubURL + "/user/change_password"
44-
middleware.SetRedirectToCookie(ctx.Resp, setting.AppSubURL+ctx.Req.URL.RequestURI())
44+
middleware.SetRedirectToCookie(ctx.Resp, ctx.Req, setting.AppSubURL+ctx.Req.URL.RequestURI())
4545
ctx.Redirect(setting.AppSubURL + "/user/settings/change_password")
4646
} else {
4747
user.Dashboard(ctx)

‎routers/web/user/setting/profile.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -407,7 +407,7 @@ func UpdateUserLang(ctx *context.Context) {
407407
}
408408

409409
// Update the language to the one we just set
410-
middleware.SetLocaleCookie(ctx.Resp, ctx.Doer.Language, 0)
410+
middleware.SetLocaleCookie(ctx.Resp, ctx.Req, ctx.Doer.Language, 0)
411411

412412
log.Trace("User settings updated: %s", ctx.Doer.Name)
413413
ctx.Flash.Success(translation.NewLocale(ctx.Doer.Language).Tr("settings.update_language_success"))

‎services/auth/auth.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ func handleSignIn(resp http.ResponseWriter, req *http.Request, sess SessionStore
8989
}
9090
}
9191

92-
middleware.SetLocaleCookie(resp, user.Language, 0)
92+
middleware.SetLocaleCookie(resp, req, user.Language, 0)
9393

9494
// Clear whatever CSRF has right now, force to generate a new one
9595
if ctx := gitea_context.GetWebContext(req); ctx != nil {

‎services/auth/middleware.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ func VerifyAuthWithOptions(options *VerifyOptions) func(ctx *context.Context) {
108108
ctx.Data["Title"] = ctx.Tr("auth.must_change_password")
109109
ctx.Data["ChangePasscodeLink"] = setting.AppSubURL + "/user/change_password"
110110
if ctx.Req.URL.Path != "/user/events" {
111-
middleware.SetRedirectToCookie(ctx.Resp, setting.AppSubURL+ctx.Req.URL.RequestURI())
111+
middleware.SetRedirectToCookie(ctx.Resp, ctx.Req, setting.AppSubURL+ctx.Req.URL.RequestURI())
112112
}
113113
ctx.Redirect(setting.AppSubURL + "/user/settings/change_password")
114114
return
@@ -136,7 +136,7 @@ func VerifyAuthWithOptions(options *VerifyOptions) func(ctx *context.Context) {
136136
if options.SignInRequired {
137137
if !ctx.IsSigned {
138138
if ctx.Req.URL.Path != "/user/events" {
139-
middleware.SetRedirectToCookie(ctx.Resp, setting.AppSubURL+ctx.Req.URL.RequestURI())
139+
middleware.SetRedirectToCookie(ctx.Resp, ctx.Req, setting.AppSubURL+ctx.Req.URL.RequestURI())
140140
}
141141
ctx.Redirect(setting.AppSubURL + "/user/login")
142142
return
@@ -151,7 +151,7 @@ func VerifyAuthWithOptions(options *VerifyOptions) func(ctx *context.Context) {
151151
if !options.SignOutRequired && !ctx.IsSigned &&
152152
len(ctx.GetSiteCookie(setting.CookieUserName)) > 0 {
153153
if ctx.Req.URL.Path != "/user/events" {
154-
middleware.SetRedirectToCookie(ctx.Resp, setting.AppSubURL+ctx.Req.URL.RequestURI())
154+
middleware.SetRedirectToCookie(ctx.Resp, ctx.Req, setting.AppSubURL+ctx.Req.URL.RequestURI())
155155
}
156156
ctx.Redirect(setting.AppSubURL + "/user/login")
157157
return

0 commit comments

Comments
 (0)