kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-12 20:15:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api)!: key the health route and keep server internals from user keys

Browse Source 
/api/health needs X-Secret-Key but stays outside the rate limit. Only the admin key gets load_errors from /api/services, default error details no longer name the exception class, and a prepare signal replaces aiohttp's Server banner on every response while the CDM routes keep their own.
This commit is contained in:
imSp4rky
2026-11-03 11:53:55 -07:00
parent b6429ecdfd
commit 87ccd6666c
16 changed files with 105 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/dev/rest-api/quickstart.md
+3 -3
View File
@@ -93,7 +93,7 @@ Swagger UI available at http://127.0.0.1:8786/api/docs/
```
!!! note "Swagger UI is also behind auth"
In `--api-only` mode (without `--no-key`), the Swagger UI at `/api/docs/` requires the `X-Secret-Key` header, the same as every other route. Only `/api/health` is exempt from authentication.
In `--api-only` mode (without `--no-key`), the Swagger UI at `/api/docs/` requires the `X-Secret-Key` header, the same as every other route.
For the rest of this page we will assume the server is reachable at `http://127.0.0.1:8786` and store the secret in an environment variable:
@@ -106,10 +106,10 @@ export BASE="http://127.0.0.1:8786"
## Step 3: Make sure that the server is alive
The health endpoint is the one route that never requires an API key. Use it to make sure that the server operates, and to read its version:
Use the health endpoint to make sure that the server operates, and to read its version. It needs the API key like every other route:
```shell
curl "$BASE/api/health"
curl -H "X-Secret-Key: $SECRET" "$BASE/api/health"
```
```json title="200 OK"