Logout doesn't work sometimes

[sryze]

Description

I've noticed two buggy scenarios that may happen sometimes when I click on the Sign Out button:

1. I'm redirected to the default (logged out) home page, but as soon as I click Sign In I'm automatically logged in, no username/password asked
2. A red error message briefly appears at the top of the page, page refresh, I'm logged in again (no username/password form). Stack trace of the error:

error when doRequest TypeError: NetworkError when attempting to fetch resource. [index.js:74:2228](https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836)
    Fm https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:74
    si https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:74
    ov https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:74
    (Async: EventListener.handleEvent)
    rv https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:74
    <anonymous> https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:233
    (Async: EventListener.handleEvent)
    Wi https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:28
    <anonymous> https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:233
    <anonymous> https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:233
    <anonymous> https://try.gitea.io/assets/js/index.js?v=1.22.0~rc1-10-gd11133b836:233

Browser: Firefox 125.0.2

Gitea Version

1.22.0+rc1-1-g7b8e418da

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

https://gist.github.com/sryze/f13d87ee13691ba29f989c7e1f6510c8

Screenshots

Git Version

2.44.0

Operating System

No response

How are you running Gitea?

From command-line, built myself. I can reproduce it on try.gitea.io as well.

Database

SQLite

[wxiaoguang]

Thank you very much for your report.

1. I'm redirected to the default (logged out) home page, but as soon as I click Sign In I'm automatically logged in, no username/password asked

What are your "Loign Sources (Authentication Sources)" on the admin panel? Did you deploy Gitea under a sub-path behind reverse proxy?

2. A red error message briefly appears at the top of the page, page refresh, I'm logged in again (no username/password form). Stack trace of the error:

I know this problem ... because Gitea reports some JS errors too aggressively, I think we could leave this problem to a new issue (it is not related to the "logout" problem)

[wxiaoguang]

For the first problem, could you also provide the browser's network logs? It might be also related to browsers/extensions, I know some browsers (or extensions) click the "login" button automatically for users if the passwords are remembered. If you could see a separate network POST request for signin, then it could be this case.

ps: I can't reproduce it on try.gitea.io ..........

[silverwind]

The JS error toast on logout i'm aware of, I think it's most likely harmless and should not hinder actual functionality. Still something we need to fix of course.

[silverwind]

I can reproduce locally like half of the times when I logout while being on the frontpage, there is definitely something fishy going on with the logout. The aborted request triggers the JS toast, and then apparently it logs back in again automatically. Maybe something related to OAuth code.

An no, my browser does not automatically click the "login", it only autofills.

[silverwind]

The JS initiator for the first GET above seems to be here:

gitea/web_src/js/features/notification.js

Line 98 in a21ca9b

window.location.href = `${appSubUrl}/`;

[wxiaoguang]

OK, 100% know the problem now, will propose a fix.

[wxiaoguang]

-> Improve logout from worker #30775

[sryze]

What are your "Loign Sources (Authentication Sources)" on the admin panel? Did you deploy Gitea under a sub-path behind reverse proxy?

I have 0 authentication sources in Admin Settings, but yes, my Gitea instance is behind a reverse proxy (Apache).

I think 1st problem has something to do with DOMAIN and ROOT_URL mismatch. If I set DOMAIN = mydevice.local and APP_URL = http://mydevice/gitea (without the .local suffix), I can reproduce it sometimes if I open Gitea via http://mydevice/gitea, otherwise it doesn't happen.

My browser doesn't auto-login, it only fills in the username/password info (similar to @silverwind's).

[sryze]

I think 1st problem has something to do with DOMAIN and ROOT_URL mismatch ...

It seems to be also related to having a missing / after the subpath. So given ROOT_URL = http://mydevice.local/gitea/ and a logged in user:

• User opens http://mydevice/gitea/ -> shows user's repositires page
• User opens http://mydevice/gitea -> shows home page - if user clicks on Sign In, they are redirected to the repositories page

Relevant Apache config:

<VirtualHost *:80>
        <Proxy *>
                Order allow,deny
                Allow from all
        </Proxy>
        AllowEncodedSlashes NoDecode
        # Note: no trailing slash after either /gitea or port
        ProxyPass /gitea http://localhost:8077 nocanon

(adapted from https://docs.gitea.com/administration/reverse-proxies)

[sryze]

Adding this rewrite rule solved it for me:

RewriteEngine on
RewriteRule ^/gitea$ /gitea/ [R]

[wxiaoguang]

I think 1st problem has something to do with DOMAIN and ROOT_URL mismatch ...

It seems to be also related to having a missing /

I think it is a new problem, when there are sub paths, the cookie handling sometimes is tricky. Could you reproduce it in a browser's Private Window (without existing cookie)?

ps: for the real 1st problem (occasionally unable to logged out & JS error), I am pretty sure it could be fixed by #30775, the real problem behind it is the "logout handler" sends 2 responses, one is for worker, one is for current page, the worker code conflicts with the cookie handling.