clawbot
145255cb51
check / check (push) Waiting to run
New tests only. MetricsAuth on its own answers 401 with a challenge without credentials or with a wrong username or password, and lets the configured ones through. A CORS preflight request gets the same Access-Control-Allow-Origin as a GET. A POST / carrying the signing key leaves the key out of the request log line, and the login handler's own log lines leave out the submitted key. The metrics middleware on its own records a request it served; the router records nothing while no metrics username is set. Not tested through the router: the basic auth in front of /metrics and recording with a metrics username set (#180). The pinned basicauth-go compares the password in constant time. Model: opus-5-5