Fix: public API toggle silently fails to save on auth/CSRF error - #57
Open
rsimplicio wants to merge 1 commit into
Open
Fix: public API toggle silently fails to save on auth/CSRF error#57rsimplicio wants to merge 1 commit into
rsimplicio wants to merge 1 commit into
Conversation
togglePublicApi() updated the switch UI optimistically before the
save request resolved, and only checked JSON body `ok` for a success
toast — a non-2xx response (expired session -> 401, stale CSRF -> 403)
left the toggle showing "on" with no error, while nothing was actually
persisted. Confirmed via direct API testing that persistence itself
was already correct; this was purely a client-side silent-failure bug.
Now the UI only updates after a confirmed 2xx + {ok:true} response,
and a failed save surfaces a visible error toast instead of failing
silently. Particularly relevant here since this setting controls
whether /api/state is exposed without authentication.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
togglePublicApi()updated the switch UI optimistically before the save request resolved, and only checked the JSON body'sokfield to show a success toast — a non-2xx response (expired session → 401, stale CSRF → 403) left the switch showing "on" with no error shown, while nothing was actually persisted server-side./api/configthat persistence itself was already correct once a request succeeds (survives disk write, restart, etc.) — this was purely a client-side silent-failure bug.2xx+{ok:true}response; a failed save surfaces a visible error toast instead of failing silently./api/stateis exposed without authentication — a silently-wrong toggle is a bigger problem on a security-relevant control than a cosmetic one.Test plan
node --checkon the extracted script block — no syntax errorsDockerfilein an isolated container{"ok":true},public_api_statecorrectly flips and persists to disk{"ok":false,"error":"CSRF validation failed"}, and disk state correctly stays unchanged rather than silently claiming success