[Feature] Fever API: Log authentication failures for e.g. fail2ban
#6.814 geöffnet am 17.09.2024
Repository-Metriken
- Stars
- (15.022 Sterne)
- PR-Merge-Metriken
- (Durchschn. Merge 11T 12h) (36 gemergte PRs in 30 T)
Beschreibung
Is your feature request related to a problem? Please describe.
On authentication failures to the fever API, {"api_version":3,"auth":0} is returned with a HTTP 200 status code, in nginx logs e.g.:
$IP - - $DATE "POST /api/fever.php?api HTTP/2.0" 200 26 "-" "$UA"
This makes it impossible for tools like fail2ban to detect and block repeated login failures from the webserver logfile, posing a security risk.
The greader API in turn already returns a 401:
$IP - - $DATE "POST /api/greader.php/accounts/ClientLogin HTTP/3.0" 401 15 "-" "$UA"
Describe the solution you’d like
If possible, return a 401 HTTP status code on fever API authentication failures, which can be detected from webserver logfiles.
The original fever API spec does not mentions HTTP codes.
Describe alternatives you’ve considered
For me, it would also be fine to be able to specifically disable the fever API via the config file, as only the greader API is used on my instance.
From my understanding, the current config variable api_enabled affects both APIs. (Btw, the description in the sample config file currently implies only the greader API exists.)
As a quick and dirty solution, I currently delete p/api/fever.php on every upgrade.