Add proper error message if session provider can not be created

routers/common/middleware.go

@@ -107,8 +107,17 @@ func ForwardedHeadersHandler(limit int, trustedProxies []string) func(h http.Han
 	return proxy.ForwardedHeaders(opt)
 }
 
-func Sessioner() func(next http.Handler) http.Handler {
-	return session.Sessioner(session.Options{
+func Sessioner() (middleware func(next http.Handler) http.Handler, err error) {
+	// Recover from panic if session.Sessioner fails due to invalid config
+	// https://gitea.com/go-chi/session/src/commit/16768d98ec9667722b876d4bed11017ce16d4572/session.go#L237-L240
+	defer func() {
+		if r := recover(); r != nil {
+			rErr := r.(error)
+			err = fmt.Errorf("failed to create session middleware: %w", rErr)
+		}
+	}()
+
+	middleware = session.Sessioner(session.Options{
 		Provider:       setting.SessionConfig.Provider,
 		ProviderConfig: setting.SessionConfig.ProviderConfig,
 		CookieName:     setting.SessionConfig.CookieName,
@@ -119,4 +128,6 @@ func Sessioner() func(next http.Handler) http.Handler {
 		SameSite:       setting.SessionConfig.SameSite,
 		Domain:         setting.SessionConfig.Domain,
 	})
+
+	return middleware, err
 }

routers/install/routes.go

@@ -8,6 +8,7 @@ import (
 	"html"
 	"net/http"
 
+	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/public"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/web"
@@ -23,7 +24,11 @@ func Routes() *web.Router {
 	base.Methods("GET, HEAD", "/assets/*", public.FileHandlerFunc())
 
 	r := web.NewRouter()
-	r.Use(common.Sessioner(), Contexter())
+	if sessionMid, err := common.Sessioner(); err == nil && sessionMid != nil {
+		r.Use(sessionMid, Contexter())
+	} else {
+		log.Fatal("common.Sessioner failed: %v", err)
+	}
 	r.Get("/", Install) // it must be on the root, because the "install.js" use the window.location to replace the "localhost" AppURL
 	r.Post("/", web.Bind(forms.InstallForm{}), SubmitInstall)
 	r.Get("/post-install", InstallDone)

routers/web/web.go

@@ -267,7 +267,11 @@ func Routes() *web.Router {
 	routes.Get("/ssh_info", misc.SSHInfo)
 	routes.Get("/api/healthz", healthcheck.Check)
 
-	mid = append(mid, common.Sessioner(), context.Contexter())
+	if sessionMid, err := common.Sessioner(); err == nil && sessionMid != nil {
+		mid = append(mid, sessionMid, context.Contexter())
+	} else {
+		log.Fatal("common.Sessioner failed: %v", err)
+	}
 
 	// Get user from session if logged in.
 	mid = append(mid, webAuth(buildAuthGroup()))