immich-app
[BUG] Missing authentication for API endpoints
Describe the bug The following API endpoints do not require authentication:
- /api/server-info/version
- /api/server-info
- /api/server-info/ping
To Reproduce Steps to reproduce the behavior:
Visit the following links without being logged in:
- https://demo.immich.app/api/server-info
- https://demo.immich.app/api/server-info/version
- https://demo.immich.app/api/server-info/ping
Expected behavior The endpoints should only be accessible for authenticated users.
For the endpoint /api/server-info/stats e.g. authentication is required.
Screenshots
One can argue that server stats should be protected, but version and ping should IMHO not require authentication.
This is even more true for the ping endpoint, as it could be used for healthchecks and liveness probes.
Yeah definitely.
Just wanted to start the discussion whether the endpoints are intended to be exposed.
Ping and health are typically exposed and ok, I agree. Just listed all.
Not so sure about the disk stats and version though. If there is a requirement, fine. However, I think these endpoints are worth to be protected.
Hey, thanks for raising, I think it's worth evaluating if we can protected the server-info endpoint for sure, this info doesn't need to be exposed to unauthenticated users
