No way to authenticate for RSS feeds

[jtracey]

Description

I'm trying to access the RSS feed of a private repo, but there doesn't seem to be a way to do that outside of a session. Neither API access tokens (preferred) nor HTTP basic auth (fallback) work, when I confirmed they do work for other endpoints. The request always tries to redirect to the login page.

Only relevant information in the logs is 303 See Other in 0.2ms @ web/web.go:139(web.registerRoutes.verifyAuthWithOptions) for the GET.

Gitea Version

1.21.11

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Gentoo

How are you running Gitea?

Gentoo gitea package with systemd.

Database

PostgreSQL

[yp05327]

FIrst, RSS is using the web side router, not the api side router:

Next, three auth methods are added in web side:

But the basic auth only fire on API, Download or on Git or LFSPaths, which is usually known as the usage of API access token, so it will not work for RSS route

So the only way you can do is using the session auth, which is using cookie I think.
Maybe we can move it to the api side.

[jtracey]

IMO handling RSS more like an API request makes sense, since browsers/web clients generally don't support RSS these days, and it's a lot easier to get feed readers to make something like an API request than it is to get them to make something like a login flow. Some clients support manually setting cookie values, but most don't, and you'd have to reset them every time they expired anyway.

[lunny]

Or we can move this rss endpoint to the allowlist of authentication with token?