Bug: Mention avatars ignore ROOT_URL after upgrade to 1.24.7

[valentin2105]

Description

🐛 Bug: Mention avatars ignore ROOT_URL after upgrade to 1.24.7

Version:
Upgraded from 1.19.x → 1.24.7

Setup:

• Gitea is hosted behind a reverse proxy

• Public URL: https://domain.tld/gitea

• Configured ROOT_URL in app.ini:

  [server]
  ROOT_URL = https://domain.tld/gitea/

Expected behavior:
When mentioning a user in an issue, PR, or comment (@username), the user’s avatar URL should respect the ROOT_URL, just like on normal pages.

Actual behavior:
After upgrading to 1.24.7, avatars for mentions are being loaded from the internal hostname instead of the configured ROOT_URL.

Example:

✅ Correct URL (on normal pages):

https://domain.tld/gitea/avatars/8ef5c96979134bd04f6c933a9fdf2461

❌ Incorrect URL (when mentioning a user):

https://vm-hostname.domain.tld:3000/gitea/avatars/8ef5c96979134bd04f6c933a9fdf2461

Project's avatar are impacted too.

We tried to add REVERSE_PROXY_TRUSTED_PROXIES = * and PUBLIC_URL_DETECTION = legacy but don't change anything.

Impact:
This breaks avatar loading for mentioned users when Gitea runs behind a reverse proxy or on a subpath, since the internal hostname is not accessible externally.

Steps to reproduce:

1. Run Gitea behind a reverse proxy on a subpath, e.g. https://domain.tld/gitea.
2. Mention a user in an issue or comment.
3. Observe the avatar request URL in the browser’s dev tools.

Notes:

• The behavior worked correctly on version 1.19.x.
• It seems that avatar URLs for mentions are now built using the internal hostname/port rather than the configured ROOT_URL.

Environment:

• Gitea 1.24.7 (binary)
• OS: Debian 12
• Database: PostgreSQL

---

Gitea Version

1.24.7

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Debian 12

How are you running Gitea?

I use Gitea binairie with systemd

Database

PostgreSQL

[wxiaoguang]

It's highly likely that your reverse proxy doesn't pass correct headers.

https://docs.gitea.com/administration/reverse-proxies

Make sure Host and X-Fowarded-Proto headers are correctly passed to Gitea to make Gitea see the real URL being visited.

[jjth]

Some server configurations cannot pass the "Host" flag to avoid breaking existing applications on the vhost (whether or not this is good practice is not the issue here; in certain legacy environments, we simply have to work with those constraints).

The documentation at https://docs.gitea.com/administration/config-cheat-sheet about PUBLIC_URL_DETECTION says:

• "legacy": generate the public URL by "Host" header if "X-Forwarded-Proto" header exists, otherwise use "ROOT_URL".
• "auto": always use "Host" header, and also use "X-Forwarded-Proto" header if it exists. If no "Host" header, use "ROOT_URL".

What I find unclear is why this mode is called "legacy" since it doesn't work the same as before.
Previously, gitea would use ROOT_URL even if the "X-Forwarded-Proto" header was set.

Also, it's quite confusing because with our current configuration, most avatars (about 95%) are displayed correctly (for example in PR comments and commits view) because they use relative urls.
On the other hand, mentions and PR review dismiss don't show the avatars because those use absolute URLs.

[wxiaoguang]

Some server configurations cannot pass the "Host" flag to avoid breaking existing applications on the vhost (whether or not this is good practice is not the issue here; in certain legacy environments, we simply have to work with those constraints).

I don't understand why you can't pass Host to the Gitea backend, it won't affect other "existing applications on the vhost"

Passing "Host" correctly is a hard requirement, it's not related to PUBLIC_URL_DETECTION

[wxiaoguang]

What I find unclear is why this mode is called "legacy" since it doesn't work the same as before.

The full history is this:

• 1.22/1.23: Refactor AppURL usage (Refactor AppURL usage #30885)
  • It started using "Host" header, and fixed a lot of bugs, and make Gitea can run on multiple domains.
• 1.24: Make public URL generation configurable (Make public URL generation configurable #34250) and Make ROOT_URL support using request Host header Make ROOT_URL support using request Host header #32564
  • "PUBLIC_URL_DETECTION=legacy"means the behavior in 1.23

Since you were using 1.19, the correct reverse proxy configuration is a hard requirement since 1.22.

If you still think you need the old 1.19 behavior, please elaborate the detailed reasons why the 1.19 behavior is must.

[wxiaoguang]

Also, it's quite confusing because with our current configuration, most avatars (about 95%) are displayed correctly (for example in PR comments and commits view) because they use relative urls. On the other hand, mentions and PR review dismiss don't show the avatars because those use absolute URLs.

That's another legacy problem which hasn't been fixed yet, the details are: