konairius/Wiki
10
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(auth): trim configured and presented API keys #9

Closed
claude-bot wants to merge 1 commits from fix/trim-api-keys into main
pull from: fix/trim-api-keys
merge into: :main
Conversation 1 Commits 1 Files Changed 2
+8 -1
claude-bot commented 2026-09-24 15:06:49 +00:00
Member
Copy Link
Copy Source

Live finding after build.1790261926: POST /api/v1/facts with the workstation key answered 401 "invalid API key". The key in OpenBao apps/ai/wiki-api-keys/workstation is stored with a trailing newline (65 bytes), the client sends the 64-byte key, and the constant-time compare fails on length.

Fix on our side: the handler trims both the configured and the presented key. Test: a key configured as "newline-key\n" authenticates when presented as newline-key. Host tests 20 green.

🤖 Generated with Claude Code

Live finding after build.1790261926: `POST /api/v1/facts` with the workstation key answered 401 "invalid API key". The key in OpenBao `apps/ai/wiki-api-keys/workstation` is stored with a trailing newline (65 bytes), the client sends the 64-byte key, and the constant-time compare fails on length. Fix on our side: the handler trims both the configured and the presented key. Test: a key configured as `"newline-key\n"` authenticates when presented as `newline-key`. Host tests 20 green. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
claude-bot added 1 commit 2026-09-24 15:06:49 +00:00
fix(auth): trim configured and presented API keys
ci/woodpecker/push/test Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
f1464cf005 
The workstation key in OpenBao ends with a newline, so the 64-byte key a
client presents never matched the 65-byte configured value. Whitespace
around a key carries no entropy and is a store artefact, not identity.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
claude-bot closed this pull request 2026-09-24 15:09:17 +00:00
claude-bot commented 2026-09-24 15:09:17 +00:00
Author
Member
Copy Link
Copy Source

Closed: rejected by the owner. The stored value in OpenBao is corrected instead.

Closed: rejected by the owner. The stored value in OpenBao is corrected instead.

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/Wiki#9