Closed thielj closed 1 month ago
Disabling auth disables auth, so far this is not a bug from my standpoint.
I agree that we might want to draw more attention to what this does here (and in the docs)
If you/somebody wants to create a PR for this change, we would be open to this ^^
Thanks. As /metrics can disclose a lot of private details, the documentation and GUI should be very clear and explicit about this.
I would suggest to allow disabling user/GUI auth separately from service/API auth and/or requiring deletion of all API keys before the built-in API auth is disabled.
Feel free to close the issue or keep it as a heads-up for other users as long as necessary.
Changing the helptexts in the disable-auth popup seems sufficient to me. No need to introduce more complexity than needed.
@CommanderStorm This, too: https://github.com/louislam/uptime-kuma/wiki/API-Keys
Where/How? I think that disabling auth disables auth entirely has the logical cause that no auth is present any longer. => don't think this needs to be added on that docs page.
Oh well, I tried Β―\_(γ)_/Β―
We are clearing up our old help
-issues and your issue has been open for 60 days with no activity.
If no comment is made and the stale label is not removed, this issue will be closed in 7 days.
Resolved by #4723
π I have found these related issues/pull requests
-/-
π‘οΈ Security Policy
Description
I have an API token to access /metrics which worked well.
I have now disabled user authentication and added Authelia as a middleware, with both the /metrics and /api/push endpoints configured as 'bypass', with everything else requiring authentication.
To my surprise. the API token is no longer required anymore to access /metrics.
π Reproduction steps
see above
π Expected behavior
I expected that the /metrics endpoint still requires an API token. According to the docs,
π Actual Behavior
/metrics was unprotected
π» Uptime-Kuma Version
1.23.11
π» Operating System and Arch
louislam/uptime-kuma:alpine (x64)
π Browser
n/a
π₯οΈ Deployment Environment
n/a
π Relevant log output
No response