panic possibly caused by many concurrent oauth sign in requests

[eliroca]

Gitea Version

1.26.2 + some patches

What happened?

2026/06/18 09:50:09 routers/web/auth/oauth.go:68:SignInOAuth() [E] SignIn: new sid '<session_id>' already exists
2026/06/18 09:50:09 .../context/context_response.go:82:(*Context).HTML() [D] Template: status/500
2026/06/18 09:50:09 routers/common/errpage.go:59:renderPanicErrorPage() [E] PANIC: session(release): new sid '<session_id>' already exists
runtime/panic.go:860 (0x55dcd46c7eb9)
code.gitea.io/gitea/modules/web/routing/logger_manager.go:118 (0x55dcd54b8135)
runtime/panic.go:860 (0x55dcd46c7eb9)
gitea.com/go-chi/session@v0.0.0-20251124165456-68e0254e989e/session.go:265 (0x55dcd5bc5304)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/handler.go:145 (0x55dcd5cb1b95)
net/http/server.go:2286 (0x55dcd4b85d28)
github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x55dcd5ca88a5)
github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x55dcd5cabb59)
net/http/server.go:2286 (0x55dcd4b85d28)
github.com/go-chi/chi/v5@v5.2.5/mux.go:73 (0x55dcd5ca9462)
github.com/go-chi/chi/v5@v5.2.5/mux.go:321 (0x55dcd5caadba)
net/http/server.go:2286 (0x55dcd4b85d28)
github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x55dcd5ca88a5)
github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x55dcd5cabb59)
net/http/server.go:2286 (0x55dcd4b85d28)
github.com/go-chi/chi/v5@v5.2.5/middleware/get_head.go:37 (0x55dcd6e805a7)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/handler.go:145 (0x55dcd5cb1b95)
net/http/server.go:2286 (0x55dcd4b85d28)
github.com/go-chi/chi/v5@v5.2.5/mux.go:73 (0x55dcd5ca9462)
github.com/go-chi/chi/v5@v5.2.5/mux.go:321 (0x55dcd5caadba)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/routers/common/maintenancemode.go:50 (0x55dcd6dbe6da)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/handler.go:145 (0x55dcd5cb1b95)
net/http/server.go:2286 (0x55dcd4b85d28)
github.com/go-chi/chi/v5@v5.2.5/chain.go:31 (0x55dcd5ca88a5)
github.com/go-chi/chi/v5@v5.2.5/mux.go:479 (0x55dcd5cabb59)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/services/context/access_log.go:125 (0x55dcd6dbfa7d)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/handler.go:145 (0x55dcd5cb1b95)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/routing/logger_manager.go:124 (0x55dcd54b7f8c)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/handler.go:145 (0x55dcd5cb1b95)
net/http/server.go:2286 (0x55dcd4b85d28)
github.com/chi-middleware/proxy@v1.1.1/middleware.go:37 (0x55dcd6dbfecf)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/handler.go:145 (0x55dcd5cb1b95)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/routers/common/middleware.go:89 (0x55dcd6dc20d6)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/handler.go:145 (0x55dcd5cb1b95)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/routers/common/middleware.go:104 (0x55dcd6dc1d0f)
net/http/server.go:2286 (0x55dcd4b85d28)
code.gitea.io/gitea/modules/web/handler.go:145 (0x55dcd5cb1b95)
net/http/server.go:2286 (0x55dcd4b85d28)
github.com/go-chi/chi/v5@v5.2.5/mux.go:90 (0x55dcd5ca9421)
code.gitea.io/gitea/modules/web/router.go:286 (0x55dcd5cb3ee2)
code.gitea.io/gitea/modules/web/router.go:221 (0x55dcd5cb3806)
net/http/server.go:3311 (0x55dcd4ba646d)
net/http/server.go:3984 (0x55dcd4b8c424)
net/http/h2_bundle.go:6412 (0x55dcd4b55cbc)
runtime/asm_amd64.s:1771 (0x55dcd46d02a0)

How are you running Gitea?

RPM packaging at https://build.opensuse.org/package/show/devel:Factory:git-workflow/gitea

[AdamMajer]

https://gitea.com/go-chi/session/pulls/12 would fix this in middleware where the panic actually happens