You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Optional administration token: defining GATEWAYLAB_AUTH_TOKEN in include/secrets.h sets the ArduinoOTA password (GATEWAYLAB_OTA_PASSWORD can override it) and requires the X-Auth-Token header on /update, /api/system/restore, /api/restore, /api/system/restart and Wi-Fi network changes. Without it the previous behaviour is kept and a warning is logged at every boot. The web interface asks for the token once per tab.
/api/system/backup no longer returns Wi-Fi passwords by default (SSIDs only). Passwords are included only with ?full=1 and a valid token. /api/system/restore ignores Wi-Fi networks unless a token is configured and valid.
CSRF protection on every write route (web server and Wi-Fi portal): a request whose Origin differs from Host gets 403 cross_origin_forbidden. Clients without an Origin header are unaffected.
