API calls returning 401 Unauthorized

[AllTaken]

• Gitea version (or commit ref): 1.12.5 built with GNU Make 4.1, go1.14.9 : bindata, sqlite, sqlite_unlock_notify
• Git version: 2.25.1
• Operating system: Ubuntu 20.04.1 LTS

Gitea is as downloaded from the Releases page.

• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
• Log gist:
  https://gist.github.com/AllTaken/e15cf3c7333d011340dfbc81e18b10c4

Description

Many different API calls result in 401 unauthorized, for no reason I can discern.
Setting up a blank repo in try.gitea.io with a single commit and trying to POST the following results in 401 unauthorized:

curl -X POST "https://try.gitea.io/api/v1/repos/test6661/Test/statuses/0b97b9b4de6c75125f635ee1f045f148ebd9b7b9" -H "accept: application/json" -H "Authorization: ba0969a9d789630ffa5321164315a27954221832" -H "Content-Type: application/json" -d "{ \"context\": \"Build\", \"description\": \"asdasdad\", \"state\": \"success\", \"target_url\": \"\"}"

Note that this happens when trying to use basic auth as well.

This used to work, probably as recently as 1.11.6

[dubiouscript]

afaik now

-H "Authorization: token ba0969a9d789630ffa5321164315a27954221832"

should work !

[AllTaken]

Yes, it really should, but it just returns 401:

[AllTaken]

Same thing happens with various API calls, here is another:

[AllTaken]

Other API calls do work like /repos/search f.ex.

[6543]

this should not be the case ...

[6543]

this works just fine:

curl -X GET "https://try.gitea.io/api/v1/repos/test6661/Test/statuses/0b97b9b4de6c75125f635ee1f045f148ebd9b7b9" -H "accept: application/json" -H "Authorization: token ba0969a9d789630ffa5321164315a27954221832"
or
curl -X GET "https://try.gitea.io/api/v1/repos/test6661/Test/statuses/0b97b9b4de6c75125f635ee1f045f148ebd9b7b9?token=ba0969a9d789630ffa5321164315a27954221832" -H "accept: application/json"

[AllTaken]

I'm fairly convinced this is a bug...

[6543]

@AllTaken I would label it as souch as soon as I can reproduce it ... my problem is, I cant :/

[6543]

can you execute the curl statement on a bash shell?

it should return []

[zeripath]

@AllTaken your authorization header is missing the "token "

[AllTaken]

I see, maybe the issue is only with basic authentication then.

[6543]

Let me se ...