Jaber JaberandGitHub 6f519b9122 fix(api): reject unauth requests from non-loopback by default (#1034) (#1071) ...

Empty api_key used to skip auth for everyone. Now it only skips auth for
loopback origins. Non-loopback requests get 401 unless the operator opts
in with OPENFANG_ALLOW_NO_AUTH=1.

- middleware: check ConnectInfo, fail closed on LAN/public origins
- ws: same fail-closed logic for WebSocket upgrades
- server: loud startup warning when bound to non-loopback with no key
- AuthState: new allow_no_auth flag
- tests: 8 new unit tests covering loopback, LAN, public, missing info

Made-with: Cursor

2026-04-17 22:45:58 +03:00

..

api_integration_test.rs

fix(api): reject unauth requests from non-loopback by default (#1034) (#1071)

2026-04-17 22:45:58 +03:00

daemon_lifecycle_test.rs

fix: resolve CI failures after rebase on upstream/main

2026-03-27 18:40:33 +00:00

load_test.rs

fix: resolve CI failures after rebase on upstream/main

2026-03-27 18:40:33 +00:00