Reverse Proxy Authentication Without Session Causing Internal Server Error

[dicksonleong]

• Gitea version (or commit ref): 1.15.0+dev-361-ga9daebca2

Description

Steps to reproduce:

1. Fresh install Gitea using docker, configure with an admin user
2. Configure reverse proxy to pass Remote-User and Remote-Email headers
3. Add/change the following in app.ini

[session]
# session is cleared when restart
PROVIDER = memory

[security]
REVERSE_PROXY_AUTHENTICATION_USER  = Remote-User
REVERSE_PROXY_AUTHENTICATION_EMAIL = Remote-Email

[service]
ENABLE_REVERSE_PROXY_AUTHENTICATION    = true
ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false

4. Restart Gitea.
5. Internal server error when try to load any page.

I briefy checked the codes, seems to be cause by the below lines:

gitea/modules/auth/sso/reverseproxy.go

Lines 81 to 83 in 6d6a65c

	if !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isGitRawOrLFSPath(req) {
	if sess.Get("uid").(int64) != user.ID {
	handleSignIn(w, req, sess, user)

My guess is: when using reverse proxy authentication, and there is no session, sess.Get("uid") will be nil, causing this error.

Exception stack trace:

2021/05/30 05:52:43 ...uters/routes/base.go:154:1() [E] PANIC: interface conversion: interface {} is nil, not int64
	/usr/local/go/src/runtime/iface.go:261 (0x412e4e)
	/go/src/code.gitea.io/gitea/modules/auth/sso/reverseproxy.go:82 (0x15006fe)
	/go/src/code.gitea.io/gitea/modules/auth/sso/user.go:25 (0x1501a67)
	/go/src/code.gitea.io/gitea/modules/context/context.go:674 (0x1b76fd0)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:70 (0x1b567ea)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:311 (0x1b5cbdb)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:436 (0x1b58c8a)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/modules/public/public.go:85 (0x161a8c7)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/modules/public/public.go:85 (0x161a8c7)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/routers/routes/base.go:211 (0x21e4090)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/gitea.com/go-chi/session/session.go:256 (0x14a976e)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:70 (0x1b567ea)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:311 (0x1b5cbdb)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:436 (0x1b58c8a)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/routers/routes/web.go:110 (0x21e54dd)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/routers/routes/base.go:39 (0x21e0fdb)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/middleware/strip.go:30 (0x21db027)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/chi-middleware/proxy/middleware.go:37 (0x21d668e)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/routers/routes/web.go:63 (0x21e501c)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:87 (0x1b56570)
	/go/src/code.gitea.io/gitea/modules/web/route.go:298 (0x1f96ab3)
	/go/src/code.gitea.io/gitea/vendor/github.com/gorilla/context/context.go:141 (0x11d56b3)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/usr/local/go/src/net/http/server.go:2887 (0x7c5022)
	/usr/local/go/src/net/http/server.go:1952 (0x7c054c)
	/usr/local/go/src/runtime/asm_amd64.s:1371 (0x47a2e0)
	
2021/05/30 05:52:43 ...outers/routes/web.go:102:1() [E] PANIC: interface conversion: interface {} is nil, not *context.APIContext
	/usr/local/go/src/runtime/iface.go:261 (0x412e4e)
	/go/src/code.gitea.io/gitea/modules/context/api.go:135 (0x21e3fde)
	/go/src/code.gitea.io/gitea/routers/routes/base.go:176 (0x21e3660)
	/usr/local/go/src/runtime/panic.go:965 (0x43fa58)
	/usr/local/go/src/runtime/iface.go:261 (0x412e4e)
	/go/src/code.gitea.io/gitea/modules/auth/sso/reverseproxy.go:82 (0x15006fe)
	/go/src/code.gitea.io/gitea/modules/auth/sso/user.go:25 (0x1501a67)
	/go/src/code.gitea.io/gitea/modules/context/context.go:674 (0x1b76fd0)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:70 (0x1b567ea)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:311 (0x1b5cbdb)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:436 (0x1b58c8a)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/modules/public/public.go:85 (0x161a8c7)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/modules/public/public.go:85 (0x161a8c7)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/routers/routes/base.go:211 (0x21e4090)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/gitea.com/go-chi/session/session.go:256 (0x14a976e)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:70 (0x1b567ea)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:311 (0x1b5cbdb)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:436 (0x1b58c8a)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/routers/routes/web.go:110 (0x21e54dd)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/routers/routes/base.go:39 (0x21e0fdb)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/middleware/strip.go:30 (0x21db027)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/chi-middleware/proxy/middleware.go:37 (0x21d668e)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/routers/routes/web.go:63 (0x21e501c)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/go/src/code.gitea.io/gitea/vendor/github.com/go-chi/chi/mux.go:87 (0x1b56570)
	/go/src/code.gitea.io/gitea/modules/web/route.go:298 (0x1f96ab3)
	/go/src/code.gitea.io/gitea/vendor/github.com/gorilla/context/context.go:141 (0x11d56b3)
	/usr/local/go/src/net/http/server.go:2069 (0x7c1a63)
	/usr/local/go/src/net/http/server.go:2887 (0x7c5022)
	/usr/local/go/src/net/http/server.go:1952 (0x7c054c)
	/usr/local/go/src/runtime/asm_amd64.s:1371 (0x47a2e0)

[zeripath]

Sorry about this.

It's due to an annoying inconsistency within the go language - I recall checking but thought that the uid was always set to something before it got to this point - clearly I was wrong.

[dicksonleong]

Thanks for the quick fix!

[zeripath]

Well I guess I did break it.