Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Require a bearer token for the Express analytics endpoint

Geschlossen
  • Stimmt etwas nicht?
#232 2 Kommentare 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@anurag2787 arbeitet bereits daran.

Seit 20.10.2026.

  • #272 von @anurag2787 — gemerged

Bewertung

Dieses Issue wurde noch nicht bewertet.

Beschreibung

enhancement good first issue hacktoberfest server

chatcopsAnalyticsHandler (packages/server/src/adapters/express.ts, lines 73 to 78) answers anyone who finds the URL. The stats aren't secret, but they show how much traffic and how many leads a site gets, which is nobody else's business.

What to do

  • Add analyticsToken?: string to ChatCopsServerConfig (packages/server/src/config.ts), with a short doc comment.
  • When it's set, chatcopsAnalyticsHandler only answers requests with Authorization: Bearer <token>. Anything else gets 401 with { "error": "unauthorized" } and a WWW-Authenticate: Bearer header.
  • Compare the tokens in constant time. Don't import node:crypto: this file is part of the same bundle Workers load. A small loop that compares every character, and checks the length, is enough.
  • When it isn't set, keep today's behavior so nothing breaks, but log one warning the first time the endpoint is hit, saying anyone can read the stats and how to set analyticsToken.
  • Update the "Reading Stats with Express" section of website/src/content/docs/core/analytics.mdx (line 18) with the option and a curl example.

Where to look

  • packages/server/src/adapters/express.ts, chatcopsAnalyticsHandler
  • packages/server/tests/adapters/express.test.ts, line 322, has the existing analytics test

Acceptance criteria

  • With analyticsToken set: the right token gets the stats, while a missing token, a wrong token and a token of a different length get 401
  • Without it: the stats are returned as today, and the warning is logged once across several requests
  • Docs updated
  • Changeset for @chatcops/server (minor, since it adds an option)
  • pnpm test:coverage and pnpm lint pass

Please get this merged by Oct 31.

Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.

Vorherrschende Sprache
TypeScript
Sterne
13
Forks
7
Ø Merge
3 Std. 28 Min.
Gemergte PRs (30 T.)
182

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus codercops/chatcops

Alle Issues in codercops/chatcops

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.