Jaber JaberandGitHub 6f519b9122 fix(api): reject unauth requests from non-loopback by default (#1034) (#1071) ...

Empty api_key used to skip auth for everyone. Now it only skips auth for
loopback origins. Non-loopback requests get 401 unless the operator opts
in with OPENFANG_ALLOW_NO_AUTH=1.

- middleware: check ConnectInfo, fail closed on LAN/public origins
- ws: same fail-closed logic for WebSocket upgrades
- server: loud startup warning when bound to non-loopback with no key
- AuthState: new allow_no_auth flag
- tests: 8 new unit tests covering loopback, LAN, public, missing info

Made-with: Cursor

2026-04-17 22:45:58 +03:00

..

src

fix(api): reject unauth requests from non-loopback by default (#1034) (#1071)

2026-04-17 22:45:58 +03:00

static

Merge pull request #1009 from normal-coder/feat-ux-optimize

2026-04-10 20:01:16 +03:00

tests

fix(api): reject unauth requests from non-loopback by default (#1034) (#1071)

2026-04-17 22:45:58 +03:00

Cargo.toml

Replace SHA256 password hashing with Argon2id for dashboard auth

2026-03-27 13:03:52 -07:00