vh/homepage
1
0
Fork 0
mirror of https://github.com/gethomepage/homepage.git synced 2026-09-29 15:31:16 -07:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Security: constant time sha comparison for mcp token, DRY

Browse Source
This commit is contained in:
shamoon
2026-07-13 10:22:44 -07:00
parent 75822f632a
commit b7fb4405e4
4 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/middleware.test.js
+2 -5
View File
@@ -131,15 +131,12 @@ describe("middleware", () => {
expect(res).toEqual({ type: "next" });
});
it("allows MCP requests with a bearer token when auth is enabled", async () => {
it("delegates MCP authorization to the API handler", async () => {
process.env.HOMEPAGE_AUTH_ENABLED = "true";
process.env.HOMEPAGE_AUTH_SECRET = "secret";
process.env.HOMEPAGE_MCP_TOKEN = "mcp-secret";
const middleware = await loadMiddleware();
const res = await middleware(
createReq("localhost:3000", "http://localhost:3000/api/mcp", { authorization: "Bearer mcp-secret" }),
);
const res = await middleware(createReq("localhost:3000", "http://localhost:3000/api/mcp"));
expect(getToken).not.toHaveBeenCalled();
expect(NextResponse.next).toHaveBeenCalled();