fix(gateway): scope tailscale tokenless auth to websocket

2026-05-09 09:37:41 +00:00 · 2026-02-21 13:03:08 +01:00
parent 6aa11f3092
commit 356d61aacf
16 changed files with 134 additions and 15 deletions
--- a/src/gateway/server-http.ts
+++ b/src/gateway/server-http.ts
@@ -155,6 +155,7 @@ async function authorizeCanvasRequest(params: {
      connectAuth: { token, password: token },
      req,
      trustedProxies,
+      allowTailscaleHeaderAuth: false,
      rateLimiter,
    });
    if (authResult.ok) {
@@ -532,6 +533,7 @@ export function createGatewayHttpServer(opts: {
            connectAuth: token ? { token, password: token } : null,
            req,
            trustedProxies,
+            allowTailscaleHeaderAuth: false,
            rateLimiter,
          });
          if (!authResult.ok) {