ilbinek
56d9e10621
Cross Compile Go / build (push) Canceled after 0s
- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts - admin API: overview stats, indexing queue, addon management (priority, reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes, traffic, metrics explorer, services, events/audit log, system info - built-in metrics: request latency per route, visitors, top addons and searches, indexer/scraper counters; minute buckets in the DB with hourly rollups and retention; optional Prometheus /metrics (METRICS_TOKEN) - POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat) and a stdlib-only Go client in telemetry/ - auth hardening: empty secrets no longer allow access, constant-time compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting - Dockerfile builds the UI and no longer bakes config.yaml into the image; CI builds the UI, runs tests and builds arm64 with CGO
20 lines
550 B
Go
20 lines
550 B
Go
package auth
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"crypto/subtle"
|
|
)
|
|
|
|
// SecretEqual compares a client-supplied secret with the configured one in
|
|
// constant time. An empty configured secret never matches, so an unset secret
|
|
// disables access instead of letting requests without the header through.
|
|
func SecretEqual(given, want string) bool {
|
|
if want == "" {
|
|
return false
|
|
}
|
|
// hashing first keeps the comparison length-independent
|
|
g := sha256.Sum256([]byte(given))
|
|
w := sha256.Sum256([]byte(want))
|
|
return subtle.ConstantTimeCompare(g[:], w[:]) == 1
|
|
}
|