HSTS preventing branch.repo.user.domain.tld subdomains from being accessed without custom domain #272

ATMmachine commented 2024年01月07日 22:54:59 +01:00

Potentially intended behavior, as use of that path is designed for DNS of custom domains whereas a custom certificate is issued—if that is the case or it's not worth changing it, simply close this issue.

Because the domain name has HSTS enabled, Firefox and other browsers will refuse to connect to subdomains on fourth and fifth levels (branch.repo.user.domain.tld). I believe this is because the certificate issued is only valid for *.codeberg.page and codeberg.page, where it needs to have *.*.*.codeberg.page, *.*.codeberg.page, *.codeberg.page, and codeberg.page. This is as wildcards in certificates only work to one level iirc, the level it is placed on (e.g. why *.codeberg.page doesn't cover codeberg.page).

This could be a Codeberg deployment specific issue, in which case please direct me to where to file that, but as certificates are issued automatically, I presume the pages-server would need modification.

Potentially intended behavior, as use of that path is designed for DNS of custom domains whereas a custom certificate is issued—if that is the case or it's not worth changing it, simply close this issue. Because the domain name has HSTS enabled, Firefox and other browsers will refuse to connect to subdomains on fourth and fifth levels (**branch**.**repo**.user.domain.tld). I believe this is because the certificate issued is only valid for \*.codeberg.page and codeberg.page, where it needs to have \*.\*.\*.codeberg.page, \*.\*.codeberg.page, \*.codeberg.page, and codeberg.page. This is as wildcards in certificates only work to one level iirc, the level it is placed on (e.g. why *.codeberg.page doesn't cover codeberg.page). This could be a Codeberg deployment specific issue, in which case please direct me to where to file that, but as certificates are issued automatically, I presume the pages-server would need modification.

crapStone commented 2024年01月09日 12:06:48 +01:00

I think this is somewhat related to #235. We need to find a solution for that problem.

I think this is somewhat related to #235. We need to find a solution for that problem.

r12t commented 2024年07月17日 07:10:04 +02:00

I'm experiencing this as well.

Repo: https://codeberg.org/r12t/robertvanbregt-nl-hallo/src/branch/pages/

Working:
https://robertvanbregt.nl/

Redirect to apex:
https://www.robertvanbregt.nl/

Certificate Errors:
https://robertvanbregt-nl-hallo.r12t.codeberg.page/
https://pages.robertvanbregt-nl-hallo.r12t.codeberg.page/

The codeberg.page domains should redirect to the custom domain, but don't.

I'm experiencing this as well. Repo: https://codeberg.org/r12t/robertvanbregt-nl-hallo/src/branch/pages/ Working: https://robertvanbregt.nl/ Redirect to apex: https://www.robertvanbregt.nl/ Certificate Errors: https://robertvanbregt-nl-hallo.r12t.codeberg.page/ https://pages.robertvanbregt-nl-hallo.r12t.codeberg.page/ The codeberg.page domains should redirect to the custom domain, but don't.

r12t commented 2024年07月17日 07:15:46 +02:00

Perhaps already known, but Netlify uses double hyphens (--) to separate users, repos and branches. Translated to Codeberg style that would become:

User page: https://username.codeberg.page/ --> https://username.codeberg.page/ (no change)

Project page: https://repo.username.codeberg.page/ --> https://repo--username.codeberg.page/

Branch page: https://branch.repo.username.codeberg.page/ --> https://branch--repo--username.codeberg.page/

Perhaps already known, but Netlify uses double hyphens (`--`) to separate users, repos and branches. Translated to Codeberg style that would become: User page: https://username.codeberg.page/ --> https://username.codeberg.page/ (no change) Project page: https://repo.username.codeberg.page/ --> https://repo--username.codeberg.page/ Branch page: https://branch.repo.username.codeberg.page/ --> https://branch--repo--username.codeberg.page/