What is wrong./metrics is mounted when DNSWATCHER_METRICS_USERNAME is set, and the Basic Auth check uses DNSWATCHER_METRICS_PASSWORD as it is, empty included. With the username set and the password unset, a request carrying that username and an empty password is let through: the library compares the two empty strings and they match. Nothing at startup says so.
Where (at e8b4006): internal/server/routes.go line 81; internal/middleware/middleware.go, MetricsAuth lines 327-342; internal/config/config.go lines 179-180.
Scenario. The operator sets DNSWATCHER_METRICS_USERNAME=prom and forgets the password. /metrics answers 200 to Authorization: Basic with prom: (empty password). What is exposed is only the Go runtime and process metrics, and the rate limit still applies, but the "behind Basic Auth" of the README is a username alone. Confirmed by reading the middleware and the library's compare; not reproduced.
Correct.CODE_STYLEGUIDE.md: a required secret is checked at startup and its absence complained about loudly. Startup refuses DNSWATCHER_METRICS_USERNAME without DNSWATCHER_METRICS_PASSWORD, naming the variable, as it refuses a bad interval.
Done when: dnswatcher refuses to start when DNSWATCHER_METRICS_USERNAME is set and DNSWATCHER_METRICS_PASSWORD is empty, with an error naming the variable; the README's variable table says the password is required with the username.
Severity: minor
Model: fable-5-1
**What is wrong.** `/metrics` is mounted when `DNSWATCHER_METRICS_USERNAME` is set, and the Basic Auth check uses `DNSWATCHER_METRICS_PASSWORD` as it is, empty included. With the username set and the password unset, a request carrying that username and an empty password is let through: the library compares the two empty strings and they match. Nothing at startup says so.
**Where** (at `e8b4006`): `internal/server/routes.go` line 81; `internal/middleware/middleware.go`, `MetricsAuth` lines 327-342; `internal/config/config.go` lines 179-180.
**Scenario.** The operator sets `DNSWATCHER_METRICS_USERNAME=prom` and forgets the password. `/metrics` answers 200 to `Authorization: Basic` with `prom:` (empty password). What is exposed is only the Go runtime and process metrics, and the rate limit still applies, but the "behind Basic Auth" of the README is a username alone. Confirmed by reading the middleware and the library's compare; not reproduced.
**Correct.** `CODE_STYLEGUIDE.md`: a required secret is checked at startup and its absence complained about loudly. Startup refuses `DNSWATCHER_METRICS_USERNAME` without `DNSWATCHER_METRICS_PASSWORD`, naming the variable, as it refuses a bad interval.
**Done when:** dnswatcher refuses to start when `DNSWATCHER_METRICS_USERNAME` is set and `DNSWATCHER_METRICS_PASSWORD` is empty, with an error naming the variable; the README's variable table says the password is required with the username.
Severity: minor
Model: fable-5-1
clawbot
added this to the 1.0 milestone 2026-10-13 12:32:09 +02:00
clawbot
self-assigned this 2026-10-13 12:32:09 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What is wrong.
/metricsis mounted whenDNSWATCHER_METRICS_USERNAMEis set, and the Basic Auth check usesDNSWATCHER_METRICS_PASSWORDas it is, empty included. With the username set and the password unset, a request carrying that username and an empty password is let through: the library compares the two empty strings and they match. Nothing at startup says so.Where (at
e8b4006):internal/server/routes.goline 81;internal/middleware/middleware.go,MetricsAuthlines 327-342;internal/config/config.golines 179-180.Scenario. The operator sets
DNSWATCHER_METRICS_USERNAME=promand forgets the password./metricsanswers 200 toAuthorization: Basicwithprom:(empty password). What is exposed is only the Go runtime and process metrics, and the rate limit still applies, but the "behind Basic Auth" of the README is a username alone. Confirmed by reading the middleware and the library's compare; not reproduced.Correct.
CODE_STYLEGUIDE.md: a required secret is checked at startup and its absence complained about loudly. Startup refusesDNSWATCHER_METRICS_USERNAMEwithoutDNSWATCHER_METRICS_PASSWORD, naming the variable, as it refuses a bad interval.Done when: dnswatcher refuses to start when
DNSWATCHER_METRICS_USERNAMEis set andDNSWATCHER_METRICS_PASSWORDis empty, with an error naming the variable; the README's variable table says the password is required with the username.Severity: minor
Model: fable-5-1