Disabling user auth also disables the API token requirement for /metrics

[thielj]

📑 I have found these related issues/pull requests

-/-

🛡️ Security Policy

• I agree to have read this project Security Policy

Description

I have an API token to access /metrics which worked well.

I have now disabled user authentication and added Authelia as a middleware, with both the /metrics and /api/push endpoints configured as 'bypass', with everything else requiring authentication.

To my surprise. the API token is no longer required anymore to access /metrics.

👟 Reproduction steps

see above

👀 Expected behavior

I expected that the /metrics endpoint still requires an API token. According to the docs,

By default, HTTP basic authentication is used to secure access to the Prometheus metrics endpoint. As soon as you add your first API key, the use of basic authentication for the endpoint will be permanently disabled.

😓 Actual Behavior

/metrics was unprotected

🐻 Uptime-Kuma Version

1.23.11

💻 Operating System and Arch

louislam/uptime-kuma:alpine (x64)

🌐 Browser

n/a

🖥️ Deployment Environment

n/a

📝 Relevant log output

No response

[CommanderStorm]

Disabling auth disables auth, so far this is not a bug from my standpoint.

I agree that we might want to draw more attention to what this does here (and in the docs)

If you/somebody wants to create a PR for this change, we would be open to this ^^

[thielj]

Thanks. As /metrics can disclose a lot of private details, the documentation and GUI should be very clear and explicit about this.

I would suggest to allow disabling user/GUI auth separately from service/API auth and/or requiring deletion of all API keys before the built-in API auth is disabled.

Feel free to close the issue or keep it as a heads-up for other users as long as necessary.

[CommanderStorm]

Changing the helptexts in the disable-auth popup seems sufficient to me. No need to introduce more complexity than needed.

[thielj]

@CommanderStorm This, too: https://github.com/louislam/uptime-kuma/wiki/API-Keys

[CommanderStorm]

Where/How?
I think that disabling auth disables auth entirely has the logical cause that no auth is present any longer. => don't think this needs to be added on that docs page.

[thielj]

Oh well, I tried ¯\_(ツ)_/¯