Mixed content warnings on newsfeed

[davidmehren]

• Gitea version (or commit ref): 1.2.0+rc1
• Git version: 2.11.0
• Operating system: Ubuntu 17.04
• Database:
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

When using the new 1.2.0 RC1, Chrome complains about mixed content on the "newsfeed" that is shown when a user is logged in.
The user profile picture on the left of each news entry is loaded using a absolute URL and HTTP:

<div class="news">
		<div class="ui left">
			<img class="ui avatar image" src="http://my.domain.net/avatars/3f01fd3bf5ae0bf66baa29afae3aadd4" alt="">
		</div>
...

1.1.2 is using relative URLs:

<div class="news">
		<div class="ui left">
			<img class="ui avatar image" src="/avatars/48b54c558b98d21bb042f4ddf2f9bf7d" alt="">
		</div>
...

Gitea is running behind a nginx reverse proxy which terminates the TLS connection to the clients.

I can not reproduce this on try.gitea.io, because that seems to be using Gravatar for profile pics, which are loaded using HTTPS.

[lunny]

@Morlinest maybe you can see this one.

[Morlinest]

@lunny I hope yes.

I think problem is when you use reverse proxy with Content Security Policy (CSP) protection enabled and serving content from other urls/ports. In NGINX config it looks like this: add_header Content-Security-Policy ....

@davidmehren Did you set your app url (in ini it is ROOT_URL) in gitea to https://my.domain.net?

[davidmehren]

Everything is fine again after I changed ROOT_URL from %(PROTOCOL)s://%(DOMAIN)s/ to https://my.domain.net.

I was first confused by this setting, because after I set PROTOCOL to https Gitea refused to start. I then realised that I need to start Gitea in HTTP mode but with an HTTPS URL (Because otherwise it expects a TLS certificate).

@Morlinest Thanks for your advice!

One last question: Why did everything work in Gitea 1.2? Was there a behaviour change in 1.3?

[DerMolly]

@davidmehren you mean 1.1.2 and 1.1.3, don't you?

[Morlinest]

@davidmehren You're welcome. I think change from relative to absolute url was done in #1779 + #1820 (new function GetActAvatar was used instead of removed ActAvatar struct value)