CORS on git smart http protocol can not work on main branch

[snowyu]

• Gitea version (or commit ref): 27c1578
• Git version: 2.25.1
• Operating system:

  Distributor ID:	Ubuntu
  Description:	Ubuntu 20.04.2 LTS
  Release:	20.04
  Codename:	focal
  

• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
• Log gist:

Description

This feature #5719(#5700) can not work now.

The browser say:

Access to XMLHttpRequest at 'http://localhost:3000/name/repo.git/info/refs?service=git-upload-pack' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

And the response header has nothing CORS header return.

The server report:

Completed OPTIONS /name/repo.git/info/refs?service=git-upload-pack 405 Method Not Allowed in 780.91µs

I've found it was incorrectly rejected before entering httpBase.

gitea/routers/web/web.go

Line 150 in 27c1578

common = append(common, context.Contexter())

The context.Contexter() reject it.

Just add the following code before context.Contexter() to fix:

	common = append(common, CorsHandler) // added here
	// Removed: toolbox.Toolboxer middleware will provide debug informations which seems unnecessary
	common = append(common, context.Contexter())

[snowyu]

It seems that the new [cors] configuration section will replace the old ACCESS_CONTROL_ALLOW_ORIGIN config.

[noerw]

So it works after you updated your config? In that case, please close this issue :)

Maybe related: #16100

[snowyu]

No，It will only work after modifying the above code.

If you have read the source code, you will find the feature of cors is the same as the ACCESS_CONTROL_ALLOW_ORIGIN config.

So I think you can deprecate the old ACCESS_CONTROL_ALLOW_ORIGIN.

[snowyu]

Enh, Maybe My changes can fix the #16100.

[lunny]

Could you send a PR to fix that? I'm thinking we may should use different cors settings for smart http, api and others.

[snowyu]

Ok. I've added support for CORS on most repo operations. But I have no idea how to wtite an unit test.

[zeripath]

In order to provide a test it would be helpful if you could simply list the requests that lightning git would make over the smart protocol - then you would simply write a test that ensures that the appropriate headers are sent back.

Another option is to point to the smart git protocol documentation here.