No authentication on admin UI or any mutating endpoint #3

New issue

Closed

opened 2026-07-28 21:00:59 +00:00 by paulloth1 · 1 comment

paulloth1 commented

2026-07-28 21:00:59 +00:00

(Migrated from github.com)

Problem

/admin and every /admin/slides/* and /admin/settings route in backend/app.py require no login/token/basic-auth of any kind. These are reachable from the whole LAN on ports 80/443/8080.

Impact

Anyone on the hackerspace network (or WiFi guests) can, with no credentials:

Add/edit/delete/reorder/enable/disable slides.
Change the rotation interval.
Force any slide to display immediately ("View now").
View the live HDMI preview and system stats (IP address, hostname, CPU temp, uptime).
Trigger the SSRF-capable /proxy endpoint (see separate issue).

There's also no CSRF protection on the POST forms, so even a "trusted network" argument doesn't fully hold — a malicious page visited by anyone on the LAN could auto-submit a form against these endpoints.

Suggested fix

Add at least HTTP Basic Auth (via a FastAPI dependency) in front of /admin* and /proxy, with credentials in an env var / local config file (not committed). A CSRF token on mutating forms would be a reasonable follow-up once auth exists.

## Problem `/admin` and every `/admin/slides/*` and `/admin/settings` route in `backend/app.py` require no login/token/basic-auth of any kind. These are reachable from the whole LAN on ports 80/443/8080. ## Impact Anyone on the hackerspace network (or WiFi guests) can, with no credentials: - Add/edit/delete/reorder/enable/disable slides. - Change the rotation interval. - Force any slide to display immediately ("View now"). - View the live HDMI preview and system stats (IP address, hostname, CPU temp, uptime). - Trigger the SSRF-capable `/proxy` endpoint (see separate issue). There's also no CSRF protection on the POST forms, so even a "trusted network" argument doesn't fully hold — a malicious page visited by anyone on the LAN could auto-submit a form against these endpoints. ## Suggested fix Add at least HTTP Basic Auth (via a FastAPI dependency) in front of `/admin*` and `/proxy`, with credentials in an env var / local config file (not committed). A CSRF token on mutating forms would be a reasonable follow-up once auth exists.

paulloth1 commented

2026-07-28 21:12:24 +00:00

(Migrated from github.com)

By design: public, unauthenticated admin access is intentional — the goal is to let anyone on the network add their own content. Not going to add auth.