`/status` accessible without auth if metrics endpoint is enabled

Open Beginner friendly
#920 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
api, authentication

Research direction

Inspect main.go around line 324 and trace how enabling --enable_endpoint_metrics registers the /status handler when authentication is configured. Reproduce the curl request with --htpasswd_file and without --allow_unauthenticated_reads; done means /status returns 401 while the endpoint remains available when unauthenticated reads are allowed.

Written by the indexing model from the issue text.

Description

  1. Running bazel-remove with --enable_endpoint_metrics and some auth, e.g. --htpasswd_file, but without --allow_unauthenticated_reads.
  2. curl http://localhost:9090/status succeeds, while it should've fail 401.

Cause: https://github.com/buchgr/bazel-remote/blob/a69b6b5ed933234d93b489ffd216bee5bb74aa06/main.go#L324 overwrites previous auth-protected statusHandler

Will send MR shortly.

Dominant language
Go
Stars
775
Forks
205
Avg merge
42m
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from buchgr/bazel-remote

All issues in buchgr/bazel-remote

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.