CSRF validation errors when OAuth is not enabled

[bohde]

Description

When upgrading to 1.21, we began experiencing sporadic CSRF validation errors on form submissions. We run a multi-container Docker setup, and found this issue only happened when the container that issued the CSRF token was not the same container that handled the form submission. In investigating the container logs, we found the following log line which seems to be the root cause:

...es/setting/oauth2.go:164:GetGeneralTokenSigningSecret() [W] OAuth2 is not enabled, unable to use a persistent signing secret, a new one is generated, which is not persistent between restarts and cluster nodes

It is possible to reproduce without multiple containers, using the following steps:

1. Run a server with the following in the config file:

[oauth2]
ENABLE = false

2. Visit any form, such as repository settings, to have a CSRF token generated
3. Restart the server
4. Submit the form
5. The user is now redirected to the home page, and the form submission did not work

It appears this log message, and the change to CSRF token generation was introduced in #29205

Gitea Version

1.21.11

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Multi-container Docker

Database

None

[wxiaoguang]

Forgot to make a complete solution in 1.22 .... will do it.

[wxiaoguang]

-> Introduce general web secret #30929