Confusion as to where reverse proxy headers go in app.ini

[yatesco]

Description

Hi, in https://docs.gitea.com/usage/authentication#reverse-proxy it states that various settings can be overridden, for example REVERSE_PROXY_AUTHENTICATION_USER. It doesn't, however, explicitly state where they should go in app.ini. Given that the only section that is referenced is [service] I naively put them in there.

Moving

REVERSE_PROXY_AUTHENTICATION_USER = Remote-User
REVERSE_PROXY_AUTHENTICATION_EMAIL = Remote-Email

to the [security] section worked.

My question is, how am I supposed to know, as a reader, that those headers shouldn't be in the [service] section? Happy to do a PR to clarify the wording if that helps?

(This is in the context of trying to configure this for Authelia forward auth via Caddy. With the header overrides set in the [service] section, Gitea failed to "notice" the authenticated user and so required additional logging in. Moving them to the [security] section and suddenly the user could login successfully.)

Gitea Version

1.22.3

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

No response

Operating System

No response

How are you running Gitea?

natively in proxmox debian LXC

Database

None

[lunny]

It should be under section service but security. I believe why it works because now they are using default values after your moving.

[wxiaoguang]

See https://github.com/go-gitea/gitea/blob/main/custom/conf/app.example.ini

[service]
ENABLE_REVERSE_PROXY_AUTHENTICATION

[security]
REVERSE_PROXY_AUTHENTICATION_EMAIL
REVERSE_PROXY_AUTHENTICATION_USER

A lot of Gitea's code is crowd-contributed (open source), so some designs are very casual. Just get used to it, or contribute to make it better ......

[flixman]

@yatesco I have come to your question looking for something else, unsuccessfully: Might you have a working setup gitea/authelia? I am getting an error in authelia an error about token_endpoint_auth_method being 'client_secret_basic', and should be client_secret_post, but if I change it to _post, then I get an error saying it should be _basic. crazy! Have you managed to make this setup work?

Edit: do not bother... it's been enough to ask the question to get it to work. Thank you!

[sxyandapp]

我也刚意识到 ENABLE_REVERSE_PROXY_AUTHENTICATION 和 REVERSE_PROXY_AUTHENTICATION_EMAIL/REVERSE_PROXY_AUTHENTICATION_USER 是放在不同的位置的 ！！！！

[lunny]

Please follow the documentation. This should be a legacy problem.

[GiteaBot]

We close issues that need feedback from the author if there were no new comments for a month. 🍵