celeronsx opened a new pull request, #9147: URL: https://github.com/apache/devlake/pull/9147
### ⚠️ Pre Checklist - [x] I have read through the [Contributing Documentation](https://devlake.apache.org/community/). - [x] I have added relevant tests. - [ ] I have added relevant documentation. - [x] I will add labels to the PR, such as `pr-type/bug-fix`, `pr-type/feature-development`, etc. ### Summary `OAuth2ProxyAuthentication` turns any `Authorization: Basic user:pass` into `common.USER` without checking the password. That was the contract of the nginx era: config-ui verified the credentials against `ADMIN_USER`/`ADMIN_PASS` and the lake kept the username for audit fields. #8854 put `auth.RequireAuth()` behind that middleware, so with `AUTH_ENABLED=true` the unverified username now passes the terminal gate and any `user:pass` reaches every non-public route on a directly exposed lake. #8880 fixed the sibling `X-Forwarded-User` branch with `FORWARDED_USER_SECRET` but left this one. The change gates the Basic branch on `AUTH_ENABLED` being off (mirroring `oidchelper.LoadConfig`: unset counts as off). With `AUTH_ENABLED=true` the accepted callers are the ones `auth.go` already logs as supported: session cookie, API key, forwarded headers with the shared secret. Legacy deployments without `AUTH_ENABLED` keep the Basic username exactly as before. ### Does this close any open issues? Closes #9146 ### Other Information **Tests.** `middlewares_basicauth_test.go`: Basic header is ignored with `AUTH_ENABLED=true`, and is still taken as the user with `AUTH_ENABLED` unset or `false`. `newProxyAuthRouter` in the existing forward-secret test gained a `WithConfig` variant so both files share the router. The new bypass test fails on `main` without the change. `go build`, `go vet` and `go test ./server/api/` are clean after `make mock`. Running as a local patch on our v1.0.3-beta17 instance since 2026-09-17: Basic returns 401, OIDC sign-in and API-key callers unaffected. **Behaviour change.** A deployment that sets `AUTH_ENABLED=true` and still relies on config-ui nginx Basic auth for the lake will start getting 401 on the API. That combination was never a verified path (the lake trusted the header blindly); `FORWARDED_USER_SECRET` from #8880 is the supported way to pass a proxy-verified identity. **Labels.** I do not have permission to set them; this is `pr-type/bug-fix`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
