Gitea: U2F doesn't work on Chrome 74

[arren-ru]

• Gitea version (or commit ref): 1.8.0
• Git version: 2.21.0
• Operating system: Archlinux
• Database (use [x]):
  
  
  
  • [x] PostgreSQL
  
  
  • [ ] MySQL
  
  
  • [ ] MSSQL
  
  
  • [ ] SQLite
  
  
• Can you reproduce the bug at https://try.gitea.io:
  
  
  
  • [x] Yes
  
  
  • [ ] No
  
  
  • [ ] Not relevant
  
  
• Log gist:

Description

U2F does not work on login, but registration works well.
Client is Chrome on MacOS.

Screenshots

[lafriks]

Works for me on chrome and macos with yubikey 5 at least (on try.gitea.io)

[lunny]

Also works for me Chrome / macOS on https://gitea.com

[arren-ru]

Ok, but what may happened with U2F for me? I tried to login with U2F on github and other several services, all fine with Yubikey, but not on try.gitea and my own hosted one.
Any ideas?

[lafriks]

Do you get any errors on developer tools console or network log?

[arren-ru]

Networks got all 200s, console is clean, no errors.
I have checked browser U2F capabilities here: https://demo.yubico.com/webauthn-technical/registration
All fine.

[techknowlogick]

@arren-ru are you using HTTPS?

[arren-ru]

@techknowlogick

@arren-ru are you using HTTPS?

Sure, otherwise U2F registration shouldn't work either

[nougad]

I get the same now - worked before. Strange thing is when I try to register a new key I get:

Could not read your security key.
Please make sure to use the correct, encrypted (https://) URL.

But my page is correctly served from https. The TLS connection is terminated in nginx in front of gogs. nginx config:

  proxy_set_header Host            $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP       $remote_addr;
  proxy_set_header X-Scheme        $scheme;

[arren-ru]

I get the same now - worked before. Strange thing is when I try to register a new key I get:

Could not read your security key.
Please make sure to use the correct, encrypted (https://) URL.

But my page is correctly served from https. The TLS connection is terminated in nginx in front of gogs. nginx config:

  proxy_set_header Host            $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP       $remote_addr;
  proxy_set_header X-Scheme        $scheme;

Same config in my front nginx

[ashimokawa]

Indeed strange, it does work on codeberg.org running gitea 1.8.0 - using haproxy as TLS terminator.

[sh0rez]

For me it broke when I updated Chrome to version 74. Downgrading to 73 solves the problem. I can reproduce this on both Linux (Ubuntu 18.04, Chromium) and OSX (Mojave, Chrome).
Firefox works on both platforms

[nougad]

I can confirm. Chromium 74 does not work (ArchLinux). Firefox 66 (ArchLinux) works.

Chrome 73 (Fedora) works, Chrome 74 (Fedora) does not work

[nephatrine]

Looks like I'm in the same boat. I updated to 74 and can no longer log in with my key in Gitea but can seemingly everywhere else. Anyone figured out what might have changed in that update that broke things?

[sh0rez]

Looks like I'm in the same boat. I updated to 74 and can no longer log in with my key in Gitea but can seemingly everywhere else. Anyone figured out what might have changed in that update that broke things?

According to the changelog of Chromium, they did not touch u2f, although I am not totally sure as I did not review every single commit.
But as literally every other application I use still works, maybe we should look into the specifics of gitea's u2f implementation? Are we doing any uncommon things?

[nougad]

I had a look at the JS and found u2fApi.register fails with {"type":"TIMEOUT","code":5}

u2f protocol:

{"data":{"type":"u2f_get_api_version_response","requestId":2,"responseData":{"js_api_version":1.1}}} 

{ 
    "type": "u2f_register_request", 
    "appId": "https://**MYDOMAIN**", 
    "registerRequests": [ 
        {   
            "version": "U2F_V2", 
            "challenge": "**SCRUBBED**" 
        }   
    ],  
    "registeredKeys": [ 
        {   
            "version": "U2F_V2", 
            "keyHandle": "", 
            "appId": "https://**MYDOMAIN**" 
        },  
        {   
            "version": "U2F_V2", 
            "keyHandle": "**SCRUBBED**", 
            "appId": "https://**MYDOMAIN**" 
        }   
    ],  
    "timeoutSeconds": 30, 
    "requestId": 5 
} 


{"data":{"type":"u2f_register_response","requestId":5,"responseData":{"errorCode":5}}} 

NOTE: I have already a key registered and trying to register a second one.

[lunny]

Please confirm you are not visit http://localhost:3000, localhost or http will not work for U2F.

[sh0rez]

No, I am visiting https://gitea.fqdn:80. TLS Termination is done by nginx. Works on Chrome 73, Firefox, but not on Chrome 74

[epyonavenger]

Also chiming in that it has stopped working for me on Chrome 74, MacOS, Windows, and Linux. Firefox appears to work fine. In my case, I'm running Gitea on a UNIX socket, and then having NGINX do the SSL work.

[lunny]

Oh, I'm in Chrome 73, MacOS. so that's a change between Chrome 73 and 74?

[epyonavenger]

Oh, I'm in Chrome 73, MacOS. so that's a change between Chrome 73 and 74?

Seems like it? I upgraded Gitea on the same day, so I was suspicious, but there's enough other people reporting the issue on Chrome 74 that it seems like it must at least be related. >:T

[sh0rez]

No, it depends on the Chrome version. We just do not know why

[isering]

Same here. U2F works on Firefox as well as Android Chrome, but not on Desktop Chrome 74. Although I can't confirm that it worked before, since I am trying to enroll U2F for the first time right now. Also running Gitea on a unix socket behind an Nginx proxy. I'd be happy to help with testing if somebody gives me directions.