Repository navigation
Require local client authentication for Light HTTP endpoints - #1
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Light's loopback HTTP service previously trusted any native local caller once the daemon owner had signed into YouVersion. Another local UID could retrieve private study backups. This addresses the moderator's finding in omacom/omarchy-plugin-marketplace#10702 (comment).
Every endpoint now requires an independent random client credential, checked before account access. The daemon rotates it at startup and writes a curl header file with mode 0600 inside the private 0700 state directory. The widget reads the header file directly, keeps the credential out of process arguments, and restricts service URLs to loopback. Existing Host/Origin checks remain in place.
Validation: all 88 Node test checks pass, including missing/incorrect client credentials and daemon credential rotation/permissions; JavaScript syntax checks and qmllint pass. Installed locally and confirmed unauthenticated backup access returns 401 while authenticated health access returns 200.