adalal/gotenberg
1
0
Fork 0
mirror of https://github.com/gotenberg/gotenberg.git synced 2026-10-08 05:23:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): warn at startup when the debug route has no authentication

Browse Source
This commit is contained in:
Julien Neuhart
2026-09-05 14:04:21 +02:00
parent 2c9fa6b6ed
commit ac825a2c03
2 changed files with 92 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
pkg/modules/api/api.go
View File

@@ -383,12 +383,37 @@ func (a *Api) Provision(ctx *gotenberg.Context) error {
// Logger.
a.logger = gotenberg.Logger(a)
a.warnInsecureDebugRoute()
// File system.
a.fs = gotenberg.NewFileSystem(new(gotenberg.OsMkdirAll))
return nil
}
// warnInsecureDebugRoute logs a warning when the debug route is reachable
// without authentication.
//
// The route reports the resolved configuration of every module, which is
// useful to an operator and equally useful to anyone else who can reach it.
// This warns rather than refuses: an operator may sit behind a gateway that
// authenticates on Gotenberg's behalf, and failing startup would break them.
func (a *Api) warnInsecureDebugRoute() {
if !a.enableDebugRoute || a.basicAuthUsername != "" || a.oidcEnabled {
return
}
if a.logger == nil {
return
}
a.logger.WarnContext(
context.Background(),
"--api-enable-debug-route (API_ENABLE_DEBUG_ROUTE) is enabled but no authentication is configured, so anyone who can reach Gotenberg can read its configuration. Set --api-enable-basic-auth (API_ENABLE_BASIC_AUTH) with GOTENBERG_API_BASIC_AUTH_USERNAME and GOTENBERG_API_BASIC_AUTH_PASSWORD, set --api-enable-oidc-auth (API_ENABLE_OIDC_AUTH), or disable the route.",
slog.String("flag", "--api-enable-debug-route"),
slog.String("env", "API_ENABLE_DEBUG_ROUTE"),
)
}
// Validate validates the module properties.
func (a *Api) Validate() error {
var err error