xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-17 15:47:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): return 401 for invalid Bearer token instead of 404 (#6459)

Browse Source 
When Authorization: Bearer is present but does not match (or is disabled),
respond with 401 Unauthorized so script authors can distinguish auth failure
from a wrong webBasePath. Requests with no Authorization header still get
404 masking; wrong base paths continue to 404 via NoRoute.

Fixes #6255

Co-authored-by: mrchatam <mrchatam@users.noreply.github.com>
This commit is contained in:
mrchatam
2026-09-12 13:22:15 +03:30
committed by GitHub
parent 958d7f138e
commit bdd351bd15
2 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/controller/api.go
+5 -1
View File
@@ -61,7 +61,11 @@ func (a *APIController) checkAPIAuth(c *gin.Context) {
} }
} }
if !session.IsLogin(c) { if !session.IsLogin(c) {
if c.GetHeader("X-Requested-With") == "XMLHttpRequest" { // A presented Bearer token is not an anonymous scan: return 401 so
// callers can distinguish a bad/disabled token from a wrong base path
// (NoRoute still 404s). XHR keeps 401; bare unauthenticated stays 404.
authHdr := c.GetHeader("Authorization")
if strings.HasPrefix(authHdr, "Bearer ") || c.GetHeader("X-Requested-With") == "XMLHttpRequest" {
c.AbortWithStatus(http.StatusUnauthorized) c.AbortWithStatus(http.StatusUnauthorized)
} else { } else {
c.AbortWithStatus(http.StatusNotFound) c.AbortWithStatus(http.StatusNotFound)
internal/web/controller/api_auth_test.go
+11 -4
View File
@@ -219,18 +219,22 @@ func TestCheckAPIAuth_EmptyVerifiedChainsFallsThrough(t *testing.T) {
} }
} }
// TestCheckAPIAuth_RejectsUnauthenticated characterizes the reject paths: no // TestCheckAPIAuth_RejectsUnauthenticated characterizes the reject paths:
// bearer token and no session yields 401 for XHR callers and 404 otherwise. // no credential → 404 (masking); XHR or a presented (but invalid) Bearer → 401
// so script authors can tell auth failure from a wrong base path.
func TestCheckAPIAuth_RejectsUnauthenticated(t *testing.T) { func TestCheckAPIAuth_RejectsUnauthenticated(t *testing.T) {
engine, _ := newAPIAuthTestEngine(t) engine, _ := newAPIAuthTestEngine(t)
cases := []struct { cases := []struct {
name string name string
xhr bool xhr bool
bearer string // empty = omit Authorization header
want int want int
}{ }{
{"xhr gets 401", true, http.StatusUnauthorized}, {"xhr gets 401", true, "", http.StatusUnauthorized},
{"non-xhr gets 404", false, http.StatusNotFound}, {"non-xhr gets 404", false, "", http.StatusNotFound},
{"invalid bearer gets 401", false, "definitely-not-a-token", http.StatusUnauthorized},
{"invalid bearer xhr gets 401", true, "definitely-not-a-token", http.StatusUnauthorized},
} }
for _, c := range cases { for _, c := range cases {
t.Run(c.name, func(t *testing.T) { t.Run(c.name, func(t *testing.T) {
@@ -238,6 +242,9 @@ func TestCheckAPIAuth_RejectsUnauthenticated(t *testing.T) {
if c.xhr { if c.xhr {
req.Header.Set("X-Requested-With", "XMLHttpRequest") req.Header.Set("X-Requested-With", "XMLHttpRequest")
} }
if c.bearer != "" {
req.Header.Set("Authorization", "Bearer "+c.bearer)
}
w := httptest.NewRecorder() w := httptest.NewRecorder()
engine.ServeHTTP(w, req) engine.ServeHTTP(w, req)
if w.Code != c.want { if w.Code != c.want {