Wrong redirection in Gitea

[mirkoSekulic]

Description

When Gitea is hosted with a subUrl (e.g. on studio.localhost/repos), there seems to be a problem with redirection.

If you provide the redirect parameter as “/”, Gitea should redirect to the root (“/”). However, it currently redirects to gitea home page. Similarly, if you pass any other parameter (e.g., “/redirected”) as the redirect_to parameter, Gitea redirects to the Gitea home page rather than the specified page.
The same issue exists with the OIDC flow.

Steps to reproduce.

Detailed instructions for reproducing the bug are described in demo repo

Gitea Version

1.21.11-rootless

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

We're using self-hosted Gitea in AKS.

Database

PostgreSQL

[wxiaoguang]

It is done intentionally to avoid "open redirect" security problem (google: https://learn.snyk.io/lesson/open-redirect/). Gitea should only redirect to the URLs which belong to itself. When you deploy Gitea in a sub-path (eg: /my-gitea), only the URLs with that sub-path are considered as the Gitea's URLs.

[mirkoSekulic]

@wxiaoguang It doesn't work with URLs under the sub-path either. In your example, with /my-gitea sub-path, if you try redirection to /my-gitea/test-url it will redirect you to /my-gitea as well.

[wxiaoguang]

How to reproduce? I see you mentioned OIDC, IIRC OIDC has a different URL check, it is not related to Gitea's redirect check.

For "redirect_to":

1. Access http://this-host.local/gitea/explore/repos
2. Click login: http://this-host.local/gitea/user/login?redirect_to=%2fgitea%2fexplore%2frepos
3. After login: http://this-host.local/gitea/explore/repos
4. It seems right, the redirect_to is respected.

[mirkoSekulic]

@wxiaoguang I updated the demo repo so to reproduce just follow the described steps.
The login url http://studio.localhost/repos/user/login?redirect_to=%2frepos%2ftest-page
returns /repos/ as Location header.

Correct, I've mentioned OIDC since our login flow doesn't work with version 1.22.0.
Our gitea is hosted under "http://studio.localhost/repos" and redirection should be to "http://studio.localhost/some-url" but similar thing happens, it's being redirected to gitea home page instead of provided redirect url. I assumed it was the same issue as the one explained in the example repo. I guess for that case I'll need to create another demo repository. But can you give feedback on the example I provided first?

[wxiaoguang]

I can't reproduce it with 1.22-nightly, and I guess it should have been fixed by " Delete legacy cookie before setting new cookie (#31306) #31317 "

The problem is that the proxy_cookie_path trick in your config doesn't really work well with Gitea's cooke sub-path handling. #31317 improved the cookie sub-path handling.

[wxiaoguang]

Could you try 1.22-nightly-rootless?

[mirkoSekulic]

@wxiaoguang I tested the nightly image. Redirection works as expected.
I will check later our OIDC login flow with nightly image and let you know.

[mirkoSekulic]

@wxiaoguang OIDC flow works fine with nightly as well.