From c9cc9bc0cb03ce6471804f0e66967d94978898ee Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 11:59:44 +0000 Subject: dashboard: going to another node's dashboard without its login page in between Going to another member's dashboard showed its login page for a moment: a browser without a session there was sent from `/admin/dashboard` to `/login` (by `auth::basic_auth`), which began a session with the token handed over and went on to the dashboard. Now the dashboard's page is served without authentication, as the login page is (it holds nothing: what it shows it reads with the browser's session). Opened with a token handed over, the page begins the session with it (`POST /auth/session`) before it reads anything; without a session, `obtainTokens` goes to the login page, as the redirect did. A request without credentials is refused at once rather than after the 1.5 s that slow down guessing passwords: nothing is guessed there, and a page without a session goes to the login page without waiting twice for it. --- src/api/dashboard/mod.rs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'src/api/dashboard/mod.rs') diff --git a/src/api/dashboard/mod.rs b/src/api/dashboard/mod.rs index 3a50ca6..9cf88a1 100644 --- a/src/api/dashboard/mod.rs +++ b/src/api/dashboard/mod.rs @@ -498,7 +498,6 @@ pub(crate) fn router(state: AppState) -> Router { // Its streams end when the node shuts down (`AppState::closing`). let closing = state.closing.subscribe(); Router::new() - .route("/admin/dashboard", get(page_html)) .route("/admin/dashboard/state", get(current_state)) .route("/admin/dashboard/events", get(events)) .route("/admin/dashboard/refresh", post(refresh)) @@ -701,8 +700,11 @@ pub(crate) async fn login_page() -> Response { guarded(LOGIN, POLICY.get_or_init(|| content_policy(LOGIN))) } -/// `GET /admin/dashboard`: the page. -async fn page_html() -> Response { +/// `GET /admin/dashboard`: the page, without authentication, as the login page (it holds +/// nothing; what it shows it reads with the browser's session, and without one it goes +/// to `/login`). So a page opened from another member's comes up at once, beginning a +/// session with the token handed over, with no login page in between. +pub(crate) async fn page_html() -> Response { static POLICY: OnceLock = OnceLock::new(); let page = page().1.as_str(); guarded(page, POLICY.get_or_init(|| content_policy(page))) -- cgit v1.3.1