Severity: Medium
Location: internal/auth/auth.go:98-102, internal/config/config.go:32
When dev_mode: true is set, the /auth/test-login endpoint is enabled, which allows creating sessions for any username with any role (including admin) without any authentication. There is no safeguard to prevent this from being accidentally enabled in a deployment:
- No warning is emitted at startup beyond a
slog.Warn (which may be missed in production log noise).
- The config can be set via the
GHP_DEV_MODE environment variable.
- There is no check that the server is listening only on localhost when dev mode is enabled.
Recommendation
- Refuse to start in dev mode if the listen address is not loopback (
127.0.0.1, ::1, localhost). Add a --force-dev-mode flag to override this check explicitly.
- Reject
/auth/test-login requests where r.RemoteAddr is not a loopback IP.
- Pass
DevMode to the web UI template context and render a prominent red warning banner on all pages when active.
Severity: Medium
Location:
internal/auth/auth.go:98-102,internal/config/config.go:32When
dev_mode: trueis set, the/auth/test-loginendpoint is enabled, which allows creating sessions for any username with any role (includingadmin) without any authentication. There is no safeguard to prevent this from being accidentally enabled in a deployment:slog.Warn(which may be missed in production log noise).GHP_DEV_MODEenvironment variable.Recommendation
127.0.0.1,::1,localhost). Add a--force-dev-modeflag to override this check explicitly./auth/test-loginrequests wherer.RemoteAddris not a loopback IP.DevModeto the web UI template context and render a prominent red warning banner on all pages when active.