feat(server): trust configured Unix socket requests - #2853
Open
qbisi wants to merge 1 commit into
Open
Conversation
- add unix_file_trusted configuration with a disabled zero-value default - grant trusted Unix socket requests an admin identity without credentials - bypass WebDAV authentication and download signatures only on the trusted socket Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
增加scheme.unix_file_trusted，使得对于来自 unix_socket 的请求免认证。一个主要的用途是供服务器内部程序使用 unix_sock 挂载 webdav 以避免使用/泄漏 API_KEY 或 PASSWORD，unix_socket 的权限组相当于已经做了身份认证，nginx proxy pass可以使用http 端口以要求身份认证
Summary / 摘要
Add
scheme.unix_file_trustedandOPENLIST_UNIX_FILE_TRUSTED; the zero-value default remainsfalse.Treat requests received through the configured Unix socket as an administrator without requiring account credentials, passwords, or an API key, including WebDAV requests.
Skip protected-download signature validation only for trusted Unix socket requests.
Keep existing HTTP and HTTPS authentication behavior unchanged.
This PR has breaking changes.
/ 此 PR 包含破坏性变更。
This PR changes public API, config, storage format, or migration behavior.
/ 此 PR 修改了公开 API、配置、存储格式或迁移行为。
This PR requires corresponding changes in related repositories.
/ 此 PR 需要关联仓库同步修改。
Testing / 测试
go test ./...go test ./internal/conf ./server/middlewares ./server ./internal/bootstrapgofmt -d internal/bootstrap/run.go internal/conf/config.go server/middlewares/auth.go server/middlewares/down.go server/webdav.go(no output)Checklist / 检查清单
/ 我已阅读 CONTRIBUTING。
/ 我确认此贡献符合仓库许可证、贡献规范和行为准则。
gofmt,go fmt, orprettierwhere applicable./ 我已按适用情况使用
gofmt、go fmt或prettier格式化变更代码。/ 我已在适用情况下请求相关维护者或代码所有者审查。
AI Disclosure / AI 使用声明
/ 此 PR 包含 AI 辅助内容。
Tools used / 使用工具:
Usage scope / 使用范围:
Code generation / 代码生成
Tests / 测试
Review assistance / 审查辅助
I have reviewed and validated all AI-assisted content included in this PR.
/ 我已审核并验证此 PR 中的所有 AI 辅助内容。
I have ensured that all AI-assisted commits include
Co-Authored-Byattribution./ 我已确保所有 AI 辅助提交都包含
Co-Authored-By归属信息。I can reproduce all AI-assisted content included in this PR without any AI tools.
/ 我可以在没有任何 AI 工具的情况下重现此 PR 中包含的所有 AI 辅助内容。