From 842862006af25fb2cc24dc5e3ccfb864015ae635 Mon Sep 17 00:00:00 2001 From: Michael SCHAL Date: Wed, 7 Jan 2026 10:16:52 +0100 Subject: [PATCH] fix(proxy): remove auth requirement to allow browser image requests, keep ssrf protection --- bin/api/proxy_handler.dart | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/bin/api/proxy_handler.dart b/bin/api/proxy_handler.dart index 09c749e..4b3dde3 100644 --- a/bin/api/proxy_handler.dart +++ b/bin/api/proxy_handler.dart @@ -51,22 +51,14 @@ class ProxyHandler { final path = request.url.path; // Only handle /api/xtream/* requests - // CRITICAL: Check path BEFORE auth so non-proxy requests fall through to static handler + // CRITICAL: Check path BEFORE anything else so non-proxy requests fall through to static handler if (!path.startsWith('api/xtream/')) { // Return 404 so Cascade tries next handler (staticHandler) return Response.notFound('Not an xtream proxy request'); } - // === AUTHENTICATION (applied only for /api/xtream/* requests) === - final token = _extractToken(request); - if (token == null) { - return Response(401, body: 'Unauthorized'); - } - - final session = _db.findSessionByToken(token); - if (session == null) { - return Response(401, body: 'Invalid or expired session'); - } + // NOTE: Authentication REMOVED from proxy to allow browser-initiated requests (img src, etc.) + // SSRF protection is still active via domain validation below. // === PROXY LOGIC === try {