search

jokob-sk / NetAlertX

🖧🔍 WIFI / LAN intruder detector. Scans for devices connected to your network and alerts you if new and unknown devices are found.
GNU General Public License v3.0
3.13k stars 187 forks source link

Homepage Widget API Error #838

Closed TheCBiker closed 3 weeks ago

TheCBiker commented 1 month ago

Is there an existing issue for this?

Current Behavior

Since version 24.10.12 an API error appears in the homepage widget. Unbenannt-1

Expected Behavior

Correct display of data fields in the homepage widget.

Steps To Reproduce

No response

app.conf

No response

docker-compose.yml

No response

What branch are you running?

Production

app.log

Error log from Homepage Widget:

API-Fehler: Invalid data URL: http://192.168.XXX.XXX:20211/php/server/devices.php?action=getDevicesTotals Antwortdaten:

<!DOCTYPE html>

NetAlert X | Log in

Debug enabled

jokob-sk commented 1 month ago

Hi @TheCBiker ,

I assume you have a password set? If so, try to disable the password functionality.

TheCBiker commented 1 month ago

ok if I remove the password it works. But why did it work with password in the previous version? Unbenannt-1

jokob-sk commented 1 month ago

Glad to hear that! These changes should increase the overall security of the application going forward. I might create some alternative ways to retrieve the data, so that it's accessible even when a password is set, but the first step is to improve the security.

TheCBiker commented 1 month ago

I understand. thank you

shamoon commented 1 month ago

Homepage dev here. So to clarify the api previously did not use any kind of auth and at some point you may add it? I’ll follow the issue here for if / when you can do and we’ll update on our side to support

jokob-sk commented 1 month ago

Thanks @shamoon 🙏if you have any suggestions how other apps are handling this, please let me know. My first thoughts would be either to exclude this API path from authentication, create a new endpoint not requiring authentication or adding support for for a API token/bearer/authentication header.

There is already a SYNC_api_token header bypass build in to support the synchronization plugin if that's something we can use if Homepage supports passing it in the request.

https://github.com/jokob-sk/NetAlertX/blob/3d9bf32ec7131d5d133fc2224ddd19375daa5f47/front/php/templates/security.php#L58

Thanks in advance for the help.

shamoon commented 1 month ago

I think token / bearer auth is ideal choice (I think this app deals with sensitive-enough stuff that leaving it completely open isn't ideal). But of course I don't know what your codebase is like and how much of a pain that is (generally Im happy to help with PRs etc but don't really have the bandwidth at the moment).

I'd say low priority but I'll follow along!

jokob-sk commented 1 month ago

Thanks, understandable. So if Homepage already supports consuming bearer tokens, then this should be already supported in NetAlertX in the current version.

Auth header: Authorization Format: Bearer <SYNC_api_token>

https://github.com/jokob-sk/NetAlertX/blob/3d9bf32ec7131d5d133fc2224ddd19375daa5f47/front/php/templates/security.php#L34-L65

Let me know if I need to support a different format or if this is already workable.

shamoon commented 1 month ago

Oh cool, yea, lemme try it out!

Sorry for being lazy, Im not super familiar with the app, where do you get the SYNC_api_token?

shamoon commented 1 month ago

Got it, and yup, works! 😎

I'll PR homepage, feel free to close this =)

Screenshot 2024-10-12 at 3 21 18 PM
jokob-sk commented 1 month ago

Nah all good :) Thanks for the help and supporting the app in Homepage

For anyone reading - you set the token in NetAlertX here:

image

Byrnesdigital commented 1 month ago

Nah all good :) Thanks for the help and supporting the app in Homepage

For anyone reading - you set the token in NetAlertX here:

image

My apologies but how does one generate an API token? This is what I'm currently staring at image

And this is the API error I'm getting on Homepage, I'm assuming for not having the api token set up in services. image

shamoon commented 1 month ago

Did you try… typing one into that field?

Byrnesdigital commented 1 month ago

Did you try… typing one into that field?

Of course....not. Wasn't sure if it was the kinda thing that had to be generated by the app itself. Managed to create a token, pop it in there, and now I'm good to go.

jokob-sk commented 1 month ago

Added a button to generate one and mentioned in teh description taht any value can be used: image

jokob-sk commented 3 weeks ago

released -> closing