Grayscale/nanobot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: keep local api serve unauthenticated

Browse Source 
maintainer edit: Align OpenAI-compatible API auth with the WebSocket channel boundary: loopback serve remains usable without a key, while wildcard binds still fail before agent initialization unless api.api_key is configured.
This commit is contained in:
chengyongru
2026-07-08 12:16:12 +08:00
committed by Xubin Ren
parent 28141ce20b
commit 883776358e
7 changed files with 25 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+1 -1
View File
@@ -107,7 +107,7 @@ File operations have path traversal protection, but:
**API Calls:**
- All external API calls use HTTPS by default
- Timeouts are configured to prevent hanging requests
- The OpenAI-compatible API server requires `api.api_key` for API routes; only `/health` remains unauthenticated for probes and load balancers
- The OpenAI-compatible API server must set `api.api_key` when binding to `0.0.0.0` or `::`; otherwise startup fails to prevent unauthenticated network access
- Consider using a firewall to restrict outbound connections if needed
**WhatsApp:**