search

ebess / advanced-nova-media-library

A Laravel Nova field for displaying, creating, updating and ordering a Spatie Media Library model.
596 stars 297 forks source link

Add Laravel Nova authentication middleware to API routes #433

Open FinnPaes opened 8 months ago

FinnPaes commented 8 months ago

Currently if you set the enable-existing-media config value to true the following endpoint is open for everyone without authentication: https://your-laravel-app.test/nova-vendor/ebess/advanced-nova-media-library/media This endpoint exposes all images in your application. Of course this should not happen and is a security risk.

This happens because sadly Laravel Nova does not protect API routes with the Laravel\Nova\Http\Middleware\Authenticate middleware by default. Reference: https://github.com/laravel/nova-issues/discussions/5496

This PR adds the Nova authenticate middleware so the API routes are only accessible by Nova authenticated users.