xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-16 23:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): return 401 for invalid Bearer token instead of 404 (#6459)

Browse Source 
When Authorization: Bearer is present but does not match (or is disabled),
respond with 401 Unauthorized so script authors can distinguish auth failure
from a wrong webBasePath. Requests with no Authorization header still get
404 masking; wrong base paths continue to 404 via NoRoute.

Fixes #6255

Co-authored-by: mrchatam <mrchatam@users.noreply.github.com>
This commit is contained in:
mrchatam
2026-09-12 13:22:15 +03:30
committed by GitHub
parent 958d7f138e
commit bdd351bd15
2 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/controller/api.go
+5 -1
View File
@@ -61,7 +61,11 @@ func (a *APIController) checkAPIAuth(c *gin.Context) {
}
}
if !session.IsLogin(c) {
if c.GetHeader("X-Requested-With") == "XMLHttpRequest" {
// A presented Bearer token is not an anonymous scan: return 401 so
// callers can distinguish a bad/disabled token from a wrong base path
// (NoRoute still 404s). XHR keeps 401; bare unauthenticated stays 404.
authHdr := c.GetHeader("Authorization")
if strings.HasPrefix(authHdr, "Bearer ") || c.GetHeader("X-Requested-With") == "XMLHttpRequest" {
c.AbortWithStatus(http.StatusUnauthorized)
} else {
c.AbortWithStatus(http.StatusNotFound)