lfg2025/archy
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases 44 Wiki Activity

security: add is_authenticated check to /lnd-connect-info backend handler (AUTH-011)

Browse Source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian 2026-03-19 14:58:16 +00:00
parent 64abb494d5
commit 48dc4a6068
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
core/archipelago/src/api/handler.rs
View File

@ -180,8 +180,11 @@ impl ApiHandler {
// Electrs status — unauthenticated (read-only sync status) // Electrs status — unauthenticated (read-only sync status)
(Method::GET, "/electrs-status") => Self::handle_electrs_status().await, (Method::GET, "/electrs-status") => Self::handle_electrs_status().await,
// LND connect info — unauthenticated (read-only, localhost only) // LND connect info — requires authenticated session (exposes admin macaroon)
(Method::GET, "/lnd-connect-info") => { (Method::GET, "/lnd-connect-info") => {
if !self.is_authenticated(&headers).await {
return Ok(Self::unauthorized());
}
Self::handle_lnd_connect_info(self.rpc_handler.clone()).await Self::handle_lnd_connect_info(self.rpc_handler.clone()).await
} }