Avoid setting Gitlab::Session on sessionless requests

app/controllers/application_controller.rb

@@ -440,6 +440,8 @@ class ApplicationController < ActionController::Base
   end
 
   def set_session_storage(&block)
+    return yield if sessionless_user?
+
     Gitlab::Session.with_session(session, &block)
   end
 

changelogs/unreleased/ce-jej-fix-git-http-with-sso-enforcement.yml

@@ -0,0 +1,5 @@
+---
+title: Avoid setting Gitlab::Session on sessionless requests and Git HTTP
+merge_request: 29146
+author:
+type: fixed

spec/controllers/application_controller_spec.rb

@@ -691,4 +691,38 @@ describe ApplicationController do
       end
     end
   end
+
+  context 'Gitlab::Session' do
+    controller(described_class) do
+      prepend_before_action do
+        authenticate_sessionless_user!(:rss)
+      end
+
+      def index
+        if Gitlab::Session.current
+          head :created
+        else
+          head :not_found
+        end
+      end
+    end
+
+    it 'is set on web requests' do
+      sign_in(user)
+
+      get :index
+
+      expect(response).to have_gitlab_http_status(:created)
+    end
+
+    context 'with sessionless user' do
+      it 'is not set' do
+        personal_access_token = create(:personal_access_token, user: user)
+
+        get :index, format: :atom, params: { private_token: personal_access_token.token }
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+  end
 end