401 Unauthorized returned for all GitLab Pages sites when access control is enabled

Summary

I have Pages access control enabled on my self-hosted GitLab instance, but it has no effect. I would like to block all public access to all Pages content on our instance, so that you must be logged into GitLab to view it.

Steps to reproduce

I have the following Pages configuration in gitlab.rb:

pages_external_url 'http://pages.ourdomain.com'
gitlab_pages['enable'] = true
gitlab_pages['listen_proxy'] = 'localhost:8090'
gitlab_pages['redirect_http'] = false
gitlab_pages['access_control'] = true
pages_nginx['enable'] = false

There is a reverse proxy upstream of GitLab that is doing SSL termination and routing of the *.pages.ourdomain.com requests to port 8090 on the GitLab host.

I have tried enabling access control at the project level (by selecting Project Members Only for Pages content), and at the instance level (by enabling the Disable public access to Pages sites option in the Admin area).

What is the current bug behavior?

I cloned the Sphinx example repository from gitlab.com and pushed it to my server. The CI job successfully ran and deployed the content to Pages. However, I can view the content no matter whether I'm logged into GitLab or not; it is viewable in my browser that is logged into GitLab, in an incognito window that is not logged in, and even by wget.

What is the expected correct behavior?

I should be able to view the Pages content if I'm in a browser session that is logged into GitLab, but not in an incognito window or from wget. I should get a 404 error in those cases.

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info

System information
System:
Current User:	git
Using RVM:	no
Ruby Version:	2.6.5p114
Gem Version:	2.7.10
Bundler Version:1.17.3
Rake Version:	12.3.3
Redis Version:	5.0.7
Git Version:	2.24.1
Sidekiq Version:5.2.7
Go Version:	unknown
GitLab information
Version:	12.8.7
Revision:	b679f55a199
Directory:	/opt/gitlab/embedded/service/gitlab-rails
DB Adapter:	PostgreSQL
DB Version:	10.9
URL:		https://gitlab.ourdomain.com
HTTP Clone URL:	https://gitlab.ourdomain.com/some-group/some-project.git
SSH Clone URL:	git@gitlab.ourdomain.com:some-group/some-project.git
Using LDAP:	no
Using Omniauth:	yes
Omniauth Providers:
GitLab Shell
Version:	11.0.0
Repository storage paths:

• default: /var/opt/gitlab/git-data/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git

Results of GitLab application Check

Expand for output related to the GitLab application check

Checking GitLab subtasks ...
Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 11.0.0 ? ... OK (11.0.0)
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Internal API available: OK
Redis available via internal API: OK
gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes
Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... LDAP is disabled in config/gitlab.yml
Checking LDAP ... Finished
Checking GitLab App ...
Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... yes
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ...
3/1 ... yes
3/2 ... yes
12/3 ... yes
3/4 ... yes
13/5 ... yes
13/6 ... yes
13/7 ... yes
2/8 ... yes
3/16 ... yes
13/17 ... yes
13/18 ... yes
8/19 ... yes
3/20 ... yes
7/21 ... yes
4/22 ... yes
7/23 ... yes
2/24 ... yes
3/25 ... yes
3/26 ... yes
3/27 ... yes
3/28 ... yes
3/29 ... yes
13/30 ... yes
3/32 ... yes
4/33 ... yes
3/34 ... yes
4/35 ... yes
4/36 ... yes
4/37 ... yes
3/38 ... yes
3/39 ... yes
3/40 ... yes
3/44 ... yes
3/46 ... yes
3/47 ... yes
3/48 ... yes
3/50 ... yes
2/51 ... yes
3/54 ... yes
2/55 ... yes
3/56 ... yes
2/57 ... yes
3/59 ... yes
3/60 ... yes
3/62 ... yes
3/63 ... yes
3/65 ... yes
3/66 ... yes
2/68 ... yes
3/69 ... yes
3/70 ... yes
3/71 ... yes
8/72 ... yes
27/74 ... yes
27/75 ... yes
3/76 ... yes
5/77 ... yes
3/78 ... yes
3/80 ... yes
3/81 ... yes
12/82 ... yes
3/84 ... yes
3/87 ... yes
5/88 ... yes
3/89 ... yes
2/92 ... yes
2/93 ... yes
4/94 ... yes
3/95 ... yes
4/96 ... yes
3/97 ... yes
3/98 ... yes
27/99 ... yes
27/100 ... yes
27/102 ... yes
3/104 ... yes
3/105 ... yes
3/106 ... yes
3/107 ... yes
2/108 ... yes
3/109 ... yes
3/110 ... yes
3/111 ... yes
8/112 ... yes
8/113 ... yes
8/115 ... yes
2/116 ... yes
2/117 ... yes
3/118 ... yes
3/119 ... yes
8/120 ... yes
27/121 ... yes
3/122 ... yes
8/123 ... yes
3/124 ... yes
8/125 ... yes
8/126 ... yes
8/127 ... yes
8/128 ... yes
8/130 ... yes
17/131 ... yes
17/133 ... yes
8/134 ... yes
8/135 ... yes
3/138 ... yes
3/139 ... yes
3/140 ... yes
3/142 ... yes
3/143 ... yes
17/144 ... yes
8/145 ... yes
7/146 ... yes
48/147 ... yes
3/148 ... yes
3/149 ... yes
3/150 ... yes
8/151 ... yes
3/152 ... yes
3/153 ... yes
56/154 ... yes
3/158 ... yes
3/159 ... yes
3/160 ... yes
3/161 ... yes
48/162 ... yes
3/163 ... yes
3/165 ... yes
3/166 ... yes
8/168 ... yes
8/169 ... yes
8/170 ... yes
8/171 ... yes
3/173 ... yes
3/174 ... yes
17/175 ... yes
58/176 ... yes
3/177 ... yes
8/178 ... yes
8/179 ... yes
3/180 ... yes
2/181 ... yes
7/182 ... yes
4/183 ... yes
3/185 ... yes
2/186 ... yes
8/187 ... yes
8/190 ... yes
8/191 ... yes
8/192 ... yes
8/194 ... yes
8/195 ... yes
8/196 ... yes
8/197 ... yes
8/198 ... yes
3/199 ... yes
3/200 ... yes
8/201 ... yes
8/202 ... yes
8/203 ... yes
8/204 ... yes
3/205 ... yes
3/206 ... yes
8/207 ... yes
8/209 ... yes
8/210 ... yes
8/212 ... yes
8/213 ... yes
8/214 ... yes
8/215 ... yes
8/216 ... yes
8/217 ... yes
8/218 ... yes
8/219 ... yes
8/220 ... yes
8/221 ... yes
27/222 ... yes
3/223 ... yes
4/225 ... yes
4/226 ... yes
8/229 ... yes
3/230 ... yes
84/231 ... yes
84/232 ... yes
3/233 ... yes
78/234 ... yes
8/235 ... yes
84/236 ... yes
3/237 ... yes
4/238 ... yes
8/239 ... yes
3/241 ... yes
84/242 ... yes
89/243 ... yes
84/244 ... yes
3/245 ... yes
3/246 ... yes
3/247 ... yes
84/249 ... yes
4/250 ... yes
4/251 ... yes
3/252 ... yes
3/253 ... yes
48/254 ... yes
89/255 ... yes
3/256 ... yes
84/257 ... yes
48/258 ... yes
8/260 ... yes
78/261 ... yes
84/262 ... yes
8/263 ... yes
8/264 ... yes
84/265 ... yes
3/266 ... yes
3/267 ... yes
78/268 ... yes
17/269 ... yes
8/270 ... yes
8/271 ... yes
8/275 ... yes
8/276 ... yes
8/278 ... yes
8/281 ... yes
4/282 ... yes
89/283 ... yes
3/285 ... yes
Redis version >= 2.8.0? ... yes
Ruby version >= 2.5.3 ? ... yes (2.6.5)
Git version >= 2.22.0 ? ... yes (2.24.1)
Git user has default SSH configuration? ... yes
Active users: ... 90
Is authorized keys file accessible? ... yes
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished