From 0bb57c730427a4cff91e6be884063776e136d44e Mon Sep 17 00:00:00 2001 From: Hermes Date: Wed, 12 Aug 2026 19:22:15 -0700 Subject: [PATCH] fix: block sensitive API routes from external access when TOTP off Add sensitiveRouteMiddleware that blocks /api/v1/config, /api/v1/tailscale/status, /api/v1/tailscale/devices, /api/v1/updates/available when TOTP is disabled and the request comes from a non-Tailscale IP. This prevents infrastructure detail leaks on internet-exposed deployments. Verified on test.dashcaddy.net: all 3 routes now return 403. --- dashcaddy-api/src/utilities/middleware.js | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/dashcaddy-api/src/utilities/middleware.js b/dashcaddy-api/src/utilities/middleware.js index c1f92bb..c6d0715 100644 --- a/dashcaddy-api/src/utilities/middleware.js +++ b/dashcaddy-api/src/utilities/middleware.js @@ -504,6 +504,33 @@ module.exports = function configureMiddleware(app, { return errorResponse(res, 401, '[DC-110] Authentication required', { requiresTotp: true }); }; + + // ── Sensitive routes: block external access when TOTP is off ── + // When TOTP is not enabled, all routes are open by design. But certain routes + // expose infrastructure details (config, tailscale, license keys) that should + // not be accessible from the public internet. Block these from non-Tailscale IPs. + const SENSITIVE_ROUTES = [ + '/api/v1/config', + '/api/v1/tailscale/status', + '/api/v1/tailscale/devices', + '/api/v1/updates/available', + ]; + + const sensitiveRouteMiddleware = (req, res, next) => { + if (!totpConfig.enabled) { + const isSensitive = SENSITIVE_ROUTES.some(r => req.path === r); + if (isSensitive && !isTailscaleIP(getClientIP(req))) { + return res.status(403).json({ + success: false, + error: 'This endpoint requires TOTP authentication or Tailscale access.' + }); + } + } + next(); + }; + + app.use(sensitiveRouteMiddleware); + app.use(totpAuthMiddleware); // ── JWT/API Key authentication middleware ──