Repository navigation
fix(api): require auth for sensitive reads - #744
Merged
Merged
Conversation
This was referenced Aug 6, 2026
…protect-sensitive-api-reads Signed-off-by: Fredrik Ahlgren <fredrik@sourceful-labs.com> # Conflicts: # go/internal/api/security.go # go/internal/api/security_test.go
Member
Author
|
Updated this branch to current master e29f8d7 and kept the change limited to sensitive read authentication plus tests and its changeset. Verified head 52f6578 locally with go test ./internal/api -count=1, make verify, and the pre-push make verify-all hook. GitHub Actions run 31165606425 is green, including Core, full stack, the app registry contract, the driver contract, changeset, and repository checks. There are no pending reviews or comments. Marking this ready for merge as part of the maintainer cleanup. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Backup archives contain persistent state and configuration, while the CalDAV credentials endpoint returns a reusable password. Remote requests could read these values without the API token.
Root cause
The shared guard treated almost every GET and HEAD request as an ordinary read. These secret-bearing routes therefore skipped its Host, Origin, fetch-metadata, and remote-token checks.
Checks
go test ./internal/api -count=1make verifymake verify-all, including Linux arm64/amd64 and Windows amd64 builds