U2F doesn't work on Chrome 74

[arren-ru]

• Gitea version (or commit ref): 1.8.0
• Git version: 2.21.0
• Operating system: Archlinux
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes
  • No
  • Not relevant
• Log gist:

Description

U2F does not work on login, but registration works well.
Client is Chrome on MacOS.

Screenshots

[lafriks]

Works for me on chrome and macos with yubikey 5 at least (on try.gitea.io)

[lunny]

Also works for me Chrome / macOS on https://gitea.com

[arren-ru]

Ok, but what may happened with U2F for me? I tried to login with U2F on github and other several services, all fine with Yubikey, but not on try.gitea and my own hosted one.
Any ideas?

[lafriks]

Do you get any errors on developer tools console or network log?

[arren-ru]

Networks got all 200s, console is clean, no errors.
I have checked browser U2F capabilities here: https://demo.yubico.com/webauthn-technical/registration
All fine.

[techknowlogick]

@arren-ru are you using HTTPS?

[arren-ru]

@techknowlogick

@arren-ru are you using HTTPS?

Sure, otherwise U2F registration shouldn't work either

[nougad]

I get the same now - worked before. Strange thing is when I try to register a new key I get:

Could not read your security key.
Please make sure to use the correct, encrypted (https://) URL.

But my page is correctly served from https. The TLS connection is terminated in nginx in front of gogs. nginx config:

  proxy_set_header Host            $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP       $remote_addr;
  proxy_set_header X-Scheme        $scheme;

[arren-ru]

I get the same now - worked before. Strange thing is when I try to register a new key I get:

Could not read your security key.
Please make sure to use the correct, encrypted (https://) URL.

But my page is correctly served from https. The TLS connection is terminated in nginx in front of gogs. nginx config:

  proxy_set_header Host            $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP       $remote_addr;
  proxy_set_header X-Scheme        $scheme;

Same config in my front nginx

[ashimokawa]

Indeed strange, it does work on codeberg.org running gitea 1.8.0 - using haproxy as TLS terminator.

[tombrk]

For me it broke when I updated Chrome to version 74. Downgrading to 73 solves the problem. I can reproduce this on both Linux (Ubuntu 18.04, Chromium) and OSX (Mojave, Chrome).
Firefox works on both platforms

[nougad]

I can confirm. Chromium 74 does not work (ArchLinux). Firefox 66 (ArchLinux) works.

Chrome 73 (Fedora) works, Chrome 74 (Fedora) does not work

[nephatrine]

Looks like I'm in the same boat. I updated to 74 and can no longer log in with my key in Gitea but can seemingly everywhere else. Anyone figured out what might have changed in that update that broke things?

[tombrk]

Looks like I'm in the same boat. I updated to 74 and can no longer log in with my key in Gitea but can seemingly everywhere else. Anyone figured out what might have changed in that update that broke things?

According to the changelog of Chromium, they did not touch u2f, although I am not totally sure as I did not review every single commit.
But as literally every other application I use still works, maybe we should look into the specifics of gitea's u2f implementation? Are we doing any uncommon things?