Gitea serves logins, the API and git over plain HTTP, with no redirect to HTTPS #133

New Issue

2026-11-07T20:15:17Z

rajames commented

2026-11-07 20:15:17 +00:00

Found

http://gitea.starshipos-f18.org/user/login and /api/v1/... answer 200 on plain HTTP, and accept Basic credentials there (a whole session's API calls and pushes went that way, 2026-11-07). Nexus, the .com and the .org all answer plain HTTP with 301 to https://. A password, an access token or a push sent to Gitea's http:// address crosses the network in the clear.

Done when

Apache's port-80 vhost for gitea.starshipos-f18.org redirects to https:// (as the other three do)
Gitea's ROOT_URL is https://...; clone URLs it shows are https
Verified: curl -sI http://gitea.starshipos-f18.org/user/login gives 301 to https; a push over https works

🤖 Filed with Claude Code -- the review after v4.0.0-alpha.3 (Captain Bob, 2026-11-07: "a list of problems, deficiencies, smells and so on placed in issues by rank priority").

### Found `http://gitea.starshipos-f18.org/user/login` and `/api/v1/...` answer **200** on plain HTTP, and accept Basic credentials there (a whole session's API calls and pushes went that way, 2026-11-07). Nexus, the .com and the .org all answer plain HTTP with **301 to https://**. A password, an access token or a push sent to Gitea's `http://` address crosses the network in the clear. ### Done when - [ ] Apache's port-80 vhost for gitea.starshipos-f18.org redirects to https:// (as the other three do) - [ ] Gitea's `ROOT_URL` is `https://...`; clone URLs it shows are https - [ ] Verified: `curl -sI http://gitea.starshipos-f18.org/user/login` gives 301 to https; a push over https works 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- the review after v4.0.0-alpha.3 (Captain Bob, 2026-11-07: "a list of problems, deficiencies, smells and so on placed in issues by rank priority").

rajames added this to the v4.0.0-alpha.4 milestone 2026-11-07 20:15:17 +00:00

rajames added the

labels 2026-11-07 20:15:17 +00:00

rajames referenced this issue

2026-11-07 20:16:16 +00:00

alpha.4: the list #147