jpmschweitzerandClaude Fable 5 c5f90cdb4f feat(auth): session/proxy auth for Wiki.js buttons; drop browser API key ...

The wikijs-integration.js embedded a full-privilege API key that was
served to every wiki visitor — it unlocked all 66 authenticated
endpoints, including page/vector deletes and index purges. That key
has been rotated out of service.

The two browser endpoints (/ingest/page, /entity-linking/link-page)
now authenticate via the NPM /library-desk/ proxy location instead of a
key: Authentik forward-auth for external users, LAN bypass for internal,
verified by a trusted proxy marker header. This is safe because
library-desk binds loopback-only, so NPM is the sole path that can set
that header. The browser holds no secret; the script calls same-origin
with credentials. Machine callers (the Scheduler) keep the Bearer key
on the container-network endpoints. verify_api_key now compares in
constant time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-20 09:02:02 +02:00

..

wikijs-integration.js

feat(auth): session/proxy auth for Wiki.js buttons; drop browser API key

2026-07-20 09:02:02 +02:00