- Ya
- 6 Agosti 2026, 23:25 UTC
- Mwandishi
- Kamo
- Ahadi ya
- a25ebb4
DocsService has no service-to-service authentication: ResourceServerConfig is anyRequest().permitAll() and OTKPreAuthFilter CONTINUES the chain when X-OTK is absent. Authorization is per-controller — an HR right on LegalPackageController, identity on LegalMemberController — and both need a session a daemon does not have. A mapping that fits neither funnel is therefore fully anonymous through APIService's /api/docs/** forward, so the filter ships BEFORE the endpoint it guards, not after. Copied from **************** including the two behaviours that matter: an unconfigured internal.auth.secret answers 503 rather than passing through (reading "no secret" as "no check" is how a control becomes a comment), and the comparison is MessageDigest.isEqual, which does not return early on the first differing byte the way String.equals does — against a freely callable endpoint that is a byte-at-a-time oracle for a cluster-wide secret. Ownership is segment-exact rather than a bare prefix, so /api/docs/legal/internal and everything under it is guarded while an unrelated future sibling is not 403'd by accident. The property is internal.auth.secret (public-chat), NOT mlos.internal-auth-secret.