airkjw/CLIProxyAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): add support for local management password validation and spoofed IP rejection

Browse Source 
- Introduced `newTestServerWithOptions` to customize server initialization in tests.
- Added `TestManagementLocalPasswordRejectsSpoofedForwardedFor` to validate security against spoofed `X-Forwarded-For` headers.
- Enabled default WebSocket authentication (`ws-auth`) in `config.example.yaml`.
- Disabled trusted proxy headers in Gin engine with appropriate logging to enhance security.
This commit is contained in:
Luis Pater
2026-05-18 01:22:45 +08:00
parent 9ef99aa766
commit 605adaa3c2
4 changed files with 30 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config.example.yaml
+1 -1
View File
@@ -143,7 +143,7 @@ routing:
session-affinity-ttl: "1h"
# When true, enable authentication for the WebSocket API (/v1/ws).
ws-auth: false
ws-auth: true
# When true, enable Gemini CLI internal endpoints (/v1internal:*).
# Default is false for safety.