@cryptotaxi247 / netdata-1 / commits / 7c64f676b

fix: bearer token creation truncates client_name and returns wrong expiry for existing tokens (#22167)

* Initial plan * fix: bearer token creation returns wrong expiry and truncates client_name Two bugs in src/web/api/http_auth.c: 1. bearer_create_token_internal: strncpyz used sizeof(bt->cloud_account_id) (16 bytes) instead of sizeof(bt->client_name) (64 bytes) when storing the client name, silently truncating it to 15 characters. This broke the dedup logic in bearer_create_token (strncmp would never match names longer than 15 chars) and saved incorrect data to on-disk token files. 2. bearer_create_token: when an existing matching token was found in the in-memory dictionary, the function returned the local `expires_s` variable (initialized to 0) instead of bt->expires_s (the actual token expiration). This caused bearer_get_token_json_response to return "expiration": 0 (Unix epoch) to the dashboard, making the dashboard believe the bearer token had already expired even though it was valid. Agent-Logs-Url: https://github.com/netdata/netdata/sessions/c468bb15-629f-46e3-ae1d-dd9694dc656d Co-authored-by: ilyam8 <22274335+ilyam8@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: ilyam8 <22274335+ilyam8@users.noreply.github.com>

Copilot committed Apr 9, 2026 at 08:48 UTC 7c64f676b8f20c9dca2b9fe7dc332eadcee00863

1 file changed +2 -2

src/web/api/http_auth.c

+2 -2

@@ -143,7 +143,7 @@ static time_t bearer_create_token_internal(nd_uuid_t token, HTTP_USER_ROLE user_

143 bt->access = access;

144

145 uuid_copy(bt->cloud_account_id, cloud_account_id);

146 - strncpyz(bt->client_name, client_name, sizeof(bt->cloud_account_id) - 1);

146 + strncpyz(bt->client_name, client_name, sizeof(bt->client_name) - 1);

147

148 if(save)

149 bearer_token_save_to_file(token, bt);

@@ -168,7 +168,7 @@ time_t bearer_create_token(nd_uuid_t *uuid, HTTP_USER_ROLE user_role, HTTP_ACCES

168 uuid_eq(cloud_account_id, bt->cloud_account_id) && // the cloud_account_id matches

169 strncmp(client_name, bt->client_name, sizeof(bt->client_name) - 1) == 0 && // the client_name matches

170 uuid_parse_flexi(bt_dfe.name, *uuid) == 0) // the token can be parsed

171 - return expires_s; /* dfe will cleanup automatically */

171 + return bt->expires_s; /* dfe will cleanup automatically */

172 }

173 dfe_done(bt);

174