From d48aa13cad73030095fd2677ec0b4cea95912eba Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 15:35:25 +0000 Subject: auth: no password prompt over the dashboard's own requests Opening a dashboard through its login page showed a 401 on /auth/login and the browser's password prompt. The page asked for its token by the browser's password first (POST /auth/login), with none to send, and the 401 carried a Basic challenge, which a browser answers with its prompt. The page now asks by its session first (POST /auth/session), then by the browser's password or the proxy's. And a 401 to a page's own requests (Sec-Fetch-Dest: empty: fetch, EventSource) carries no challenge: a page has its login of its own. Navigations and clients without the header (curl) are still challenged. --- src/api/dashboard/dashboard.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/api/dashboard') diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html index b80e0d2..0f31d7c 100644 --- a/src/api/dashboard/dashboard.html +++ b/src/api/dashboard/dashboard.html @@ -2314,10 +2314,10 @@ async function obtainTokens() { clearTimeout(tokenTimer); try { // Refreshed as the session (`POST /auth/session`), whose cookie lets the page in; - // the first: by the browser's password or the proxy's, else by that cookie. + // the first: by that cookie, else by the browser's password or the proxy's. token = token && token.expiresAt > Date.now() + 60000 ? await tokenCall("../auth/session", token.token) - : await tokenCall("../auth/login").catch(() => tokenCall("../auth/session")); + : await tokenCall("../auth/session").catch(() => tokenCall("../auth/login")); narrowToken = await tokenCall("../auth/refresh", token.token, { limit: READ_MEMBERS }); tokenWhy = null; const life = Math.min(token.expiresAt, narrowToken.expiresAt) - Date.now(); -- cgit v1.3.1