Repository navigation
fix(self-host): require an access token for every route - #223
Merged
Merged
Conversation
The self-host server answered every page and API route without knowing the caller. Add a middleware gate: - TONGFLOW_AUTH_TOKEN set: requests need the token as a cookie (set by opening any page with ?token=) or a Bearer header. - Unset: only loopback Host headers are served; `pnpm dev` / `pnpm start` now bind 127.0.0.1. - The Docker image always runs with a token: the entrypoint generates one into /data/auth-token and prints the login link. Compose and the README docker command publish the port on 127.0.0.1. /api/engine-assets and /api/task/webhook keep their own token checks. src/middleware.ts is now tracked; a cloud shell still replaces it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens the self-hosted server's access control.
src/lib/api/self-host-gate.ts) in front of all pages and API routes.TONGFLOW_AUTH_TOKENset → token required (HttpOnly SameSite=Strict cookie via a one-time?token=link, orAuthorization: Bearer).pnpm dev/pnpm startbind127.0.0.1./data/auth-tokenwhen none is set and prints the login link; Compose / README publish on127.0.0.1./api/engine-assetsand/api/task/webhookkeep their own token checks. Uploads (/api/uploads/*.png) are no longer skipped by extension.src/middleware.tsis now tracked (cloud shell still overwrites it at link time)..env.exampleupdated.Breaking for self-hosters: Docker users open the link from
docker logsonce; source users who reach the server from another machine must setTONGFLOW_AUTH_TOKEN.Verified: unit tests (7 new), full suite, lint, typecheck, build, and
next startprobes (401 without credentials, 200 with cookie/Bearer, 403 for a non-loopback Host without a token).🤖 Generated with Claude Code