dev: clearer error for external software
Massimo Melina committed
Apr 20, 2024 at 15:38 UTC
2bb6e47e6516475385913829166d39465c77f2b2
2 files changed
+2
-1
admin/src/AccountForm.ts
+1
@@ -119,6 +119,7 @@ export default function AccountForm({ account, done, groups, addToBar, reload }:
119
})
120
}
121
122
+// you can set password directly in add/set_account, but using this api instead will add extra security because it is not sent as clear-text, so it's especially good if you are not in localhost and not using https
123
export async function apiNewPassword(username: string, password: string) {
124
const srp6aNimbusRoutines = new SRPRoutines(new SRPParameters())
125
const res = await createVerifierAndSalt(srp6aNimbusRoutines, username, password)
src/apiMiddleware.ts
+1
-1
@@ -29,7 +29,7 @@ export function apiMiddleware(apis: ApiHandlers) : Koa.Middleware {
29
const safe = isPost && ctx.get('x-hfs-anti-csrf') // POST is safe because browser will enforce SameSite cookie
30
|| apiName.startsWith('get_') // "get_" apis are safe because they make no change
31
if (!safe)
32
- return send(HTTP_FOOL)
32
+ return send(HTTP_FOOL, "missing header x-hfs-anti-csrf=1")
33
const apiFun = apis.hasOwnProperty(apiName) && apis[apiName]!
34
if (!apiFun)
35
return send(HTTP_NOT_FOUND, 'invalid api')