From 216ccf0be5a63c2ce60fe46f7efeea07bdcbf8b1 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 4 Feb 2026 12:39:19 +0000 Subject: [PATCH] Require auth for socket.io js --- internal/api/security_regression_test.go | 25 ++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/internal/api/security_regression_test.go b/internal/api/security_regression_test.go index 028180da1..eb2537bec 100644 --- a/internal/api/security_regression_test.go +++ b/internal/api/security_regression_test.go @@ -170,6 +170,31 @@ func TestSocketIORequiresAuthInAPIMode(t *testing.T) { } } +func TestSocketIOJSRequiresAuth(t *testing.T) { + rawToken := "socket-js-token-123.12345678" + record := newTokenRecord(t, rawToken, []string{config.ScopeMonitoringRead}, nil) + cfg := newTestConfigWithTokens(t, record) + router := NewRouter(cfg, nil, nil, nil, nil, "1.0.0") + + req := httptest.NewRequest(http.MethodGet, "/socket.io/socket.io.js", nil) + rec := httptest.NewRecorder() + router.Handler().ServeHTTP(rec, req) + if rec.Code != http.StatusUnauthorized { + t.Fatalf("expected 401 without token, got %d", rec.Code) + } + + req = httptest.NewRequest(http.MethodGet, "/socket.io/socket.io.js", nil) + req.Header.Set("X-API-Token", rawToken) + rec = httptest.NewRecorder() + router.Handler().ServeHTTP(rec, req) + if rec.Code != http.StatusFound { + t.Fatalf("expected 302 redirect with token, got %d", rec.Code) + } + if location := rec.Header().Get("Location"); !strings.Contains(location, "socket.io.min.js") { + t.Fatalf("expected CDN redirect, got %q", location) + } +} + func TestSocketIOWebSocketRequiresAuthInAPIMode(t *testing.T) { rawToken := "socket-ws-token-123.12345678" record := newTokenRecord(t, rawToken, []string{config.ScopeMonitoringRead}, nil)