jb/paseo
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(server): put /api/status behind password auth

Browse Source 
Only /api/health remains public for liveness probes. /api/status
exposes hostname, version, and server ID which shouldn't be
accessible without authentication.
This commit is contained in:
Mohamed Boudra
2026-05-01 21:16:56 +07:00
parent a4a6713550
commit 829f3f7460
4 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public-docs/configuration.md
+1 -1
View File
@@ -91,7 +91,7 @@ Legacy fields `log.level` and `log.format` are still supported and map to the ne
## Password authentication
You can require a password to connect to the daemon. When set, all HTTP and WebSocket clients must authenticate — except the health and status endpoints (`/api/health`, `/api/status`).
You can require a password to connect to the daemon. When set, all HTTP and WebSocket clients must authenticate. Only the `/api/health` liveness endpoint is exempt, so that process supervisors and load balancers can probe without credentials.
The easiest way to set a password is with the CLI: