Attach auth headers for admin API calls#74
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
Codex Review: Here are some suggestions.
Reply with @codex fix comments to fix any unresolved comments.
About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".
| @@ -2,6 +2,7 @@ import { useState, useEffect } from "react"; | |||
| import axios from "axios"; | |||
|
|
|||
| const BASE_URL = process.env.NEXT_PUBLIC_BACKEND_URL || "/api"; | |||
There was a problem hiding this comment.
[P0] Avoid exposing server API key to the browser
Declaring NEXT_PUBLIC_API_KEY and attaching it to Axios defaults means the admin API key is bundled into the client and sent on every request. In backend/middleware/authMiddleware.js the middleware grants access when either an x-api-key or a JWT is present, so anyone who loads the site can read the API key from the bundle and call /admin/* routes without logging in. This effectively bypasses authentication for the admin API. The key should stay server-side or the middleware must require a token even when a key is present.
Useful? React with 👍 / 👎.
1 participant
Summary
x-api-keyin loginTesting
npm testnode -e "<mock login script>"https://chatgpt.com/codex/tasks/task_e_68b4ea3882188321b49beca4744b2bb5