Basic authentication doesn't work for archive downloads

[pvgoran]

Description

I have a private repository, and I need to download its archives (URLs like https://my.gitea.site/owner/repo/archive/.tar.gz) non-interactively using Basic Authentication. (Specifically, I need to download with the builtins.fetchTarball function of Nix package manager.) It doesn't work out of the box:

> > curl --dump-header - -u :REDACTED -o /dev/null https://REDACTED/REDACTED/REDACTED/archive/REDACTED.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/2 303 
server: nginx
date: Tue, 15 Jul 2025 15:13:01 GMT
content-type: text/html; charset=utf-8
content-length: 38
cache-control: max-age=0, private, must-revalidate, no-transform
location: /user/login
set-cookie: session=e685bd6a270841fa; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _csrf=YObR-Ve7B-AnJXJtfpjTtk5YrUA6MTc1MjU5MjM4MTk0ODAwNDg1Ng; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax
set-cookie: redirect_to=%2FREDACTED.tar.gz; Path=/; HttpOnly; Secure; SameSite=Lax
x-frame-options: SAMEORIGIN

100    38  100    38    0     0    608      0 --:--:-- --:--:-- --:--:--   612

(The password specified in curl's -u option is an Access Token with the read:repository permission of a user that is allowed to access the repository.)

I use a patched version of Gitea to make it work.

Gitea Version

1.24.2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

2025/07/15 15:19:55 ...eb/routing/logger.go:102:func1() [I] router: completed GET /REDACTED/REDACTED/archive/REDACTED.tar.gz for 127.0.0.1:34664, 303 See Other in 0.5ms @ web/web.go:139(web.registerWebRoutes.verifyAuthWithOptions)

Screenshots

No response

Git Version

2.49.0

Operating System

NixOS

How are you running Gitea?

NixOS' gitea module with the standard Nixpkgs' gitea package, behind Nginx reverse proxy.

Database

PostgreSQL

[pvgoran]

Here is the patch that allows me to make archive downloads working:

diff --git a/services/auth/basic.go b/services/auth/basic.go
index 1184d12d1c4b..bc3c9b67586e 100644
--- a/services/auth/basic.go
+++ b/services/auth/basic.go
@@ -42,8 +42,8 @@ func (b *Basic) Name() string {
 // name/token on successful validation.
 // Returns nil if header is empty or validation fails.
 func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
-       // Basic authentication should only fire on API, Download or on Git or LFSPaths
-       if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) {
+       // Basic authentication should only fire on API, Download, Archives or on Git or LFSPaths
+       if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isArchivePath(req) && !isGitRawOrAttachOrLFSPath(req) {
                return nil, nil
        }

(It won't apply on main because of #33371.)

[pvgoran]

Related issues:
#27204 (fixed by #27486)
#32458 (fixed by #33371)

[wxiaoguang]

(It won't apply on main because of #33371.)

Then it should be like this on main:

diff --git a/services/auth/basic.go b/services/auth/basic.go
index b2bd14ef5d..4be1ed042c 100644
--- a/services/auth/basic.go
+++ b/services/auth/basic.go
@@ -49,7 +49,7 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
        // Basic authentication should only fire on API, Feed, Download or on Git or LFSPaths
        // Not all feed (rss/atom) clients feature the ability to add cookies or headers, so we need to allow basic auth for feeds
        detector := newAuthPathDetector(req)
-       if !detector.isAPIPath() && !detector.isFeedRequest(req) && !detector.isContainerPath() && !detector.isAttachmentDownload() && !detector.isGitRawOrAttachOrLFSPath() {
+       if !detector.isAPIPath() && !detector.isFeedRequest(req) && !detector.isContainerPath() && !detector.isAttachmentDownload() && !detector.isGitRawOrAttachOrLFSPath() && !detector.isArchivePath() {
                return nil, nil
        }

[pvgoran]

Then it should be like this on main:

Well, I'd rather place !detector.isArchivePath() after !detector.isAttachmentDownload() rather than at the end, and also the comment above needs to be updated, too.

I'm going to create a proper PR when I have some more free time.