From 2169ec9853c595a64cbc06559f3e19a3232b00eb Mon Sep 17 00:00:00 2001 From: Krystie Date: Wed, 8 Jul 2026 21:43:12 -0700 Subject: [PATCH] DC-044: fix slice(13) -> slice(12) for /api/v1/auth/totp/check-session drift MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Slice(13) was off by one — it dropped the leading '/' before 'totp/' producing /api/v1totp/check-session. Should be slice(12) so the '/' stays. --- dashcaddy-api/src/app.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dashcaddy-api/src/app.js b/dashcaddy-api/src/app.js index 966e591..6cc5846 100644 --- a/dashcaddy-api/src/app.js +++ b/dashcaddy-api/src/app.js @@ -220,8 +220,8 @@ async function createApp() { req.url = '/api/v1' + req.url.slice(9); // '/api/auth'.length === 9 } else if (req.url.startsWith('/api/v1/auth/totp/check-session')) { // Drift: /api/v1/auth/totp/check-session -> /api/v1/totp/check-session - // Drop the '/api/v1' prefix AND the '/auth' middle segment (13 chars total). - req.url = '/api/v1' + req.url.slice(13); // '/api/v1/auth'.length === 13 + // Drop the '/api/v1/auth' prefix (12 chars), keep the leading '/'. + req.url = '/api/v1' + req.url.slice(12); // '/api/v1/auth'.length === 12 } next(); });