gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-22 19:23:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: properly handle hashed API tokens in auth checks

Browse Source 
The export/import handlers were using direct string comparison for API tokens
instead of proper hash comparison. This caused auth to fail when tokens were
stored as hashes (which is what the security wizard does).

addresses #314
This commit is contained in:
Pulse Monitor
2025-08-14 12:18:36 +00:00
parent 210e8c110a
commit b2573a1ee3
1 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/router.go
+17 -3
View File
@@ -352,7 +352,7 @@ echo "You will need to log in with your saved credentials."
} else if isDocker {
// For Docker, save credentials to persistent storage
// Docker containers need to persist auth config to /etc/pulse
// Docker containers need to persist auth config to /data
envPath := filepath.Join(r.config.ConfigPath, ".env")
envContent := fmt.Sprintf(`# Auto-generated by Pulse Quick Security Setup
# Generated on %s
@@ -552,7 +552,14 @@ ENABLE_AUDIT_LOG=true
hasValidAPIToken := false
if r.config.APIToken != "" {
authHeader := req.Header.Get("X-API-Token")
hasValidAPIToken = (authHeader == r.config.APIToken)
// Check if stored token is hashed or plain text
if internalauth.IsAPITokenHashed(r.config.APIToken) {
// Compare against hash
hasValidAPIToken = internalauth.CompareAPIToken(authHeader, r.config.APIToken)
} else {
// Plain text comparison (legacy)
hasValidAPIToken = (authHeader == r.config.APIToken)
}
}
// If password auth is configured, session auth is sufficient
@@ -625,7 +632,14 @@ ENABLE_AUDIT_LOG=true
hasValidAPIToken := false
if r.config.APIToken != "" {
authHeader := req.Header.Get("X-API-Token")
hasValidAPIToken = (authHeader == r.config.APIToken)
// Check if stored token is hashed or plain text
if internalauth.IsAPITokenHashed(r.config.APIToken) {
// Compare against hash
hasValidAPIToken = internalauth.CompareAPIToken(authHeader, r.config.APIToken)
} else {
// Plain text comparison (legacy)
hasValidAPIToken = (authHeader == r.config.APIToken)
}
}
// If password auth is configured, session auth is sufficient