#Authentik exposes protected path

1 messages · Page 1 of 1 (latest)

strange gulch
#

Is this a app you have written? Maybe the upload part is just the frontend?

#

Basically if it is a single page app, then the upload-part is just frontend. That means the user loads the whole frontend and as such its on principle accessible. (Basically when the user clicks on the logo, the JS code/browser wont REALLY go to the restricted /path , so thats nothing authentik or your reverse proxy can prevent, instead the client side JS code will tell the browser to show /path and then switch the template which is already on the client side)
If correctly configured, then uploading it self should not be possible

The only way then to restrict that users can click on the logo is by modifying the nodejs application itself

ocean flare
#

Thank you for taking the time to reply to my issue. I can't set an expression that redirects to home page / is restricted when it's done by unauthorised users?

#

If I click on the logo and I check in inspect -> network then I see a request being made, that might be able to intercept and block when done by unauthorized user right? @strange gulch

strange gulch
#

Yes the Network Request itself you can block, but it might (or might not) be responsible for switchting the page. Actually if you only allowed ^/download/* it should already been blocked if its not under download.

However if its a single page app, you cannot block it switching to another path like / because thats purely client-side.

ocean flare
#

That sucks... I tried to modify the page by removing all href in the logo, but it seems not to work as well. It's this software: https://github.com/timvisee/send. Host it in Docker.

I want to use the upload feature internally for internal users and the download feature for whoever got the link...

strange gulch
#

Ah its indeed single page like I thought, however with a custom framework (which is rather unusual)

ocean flare
#

I just did, but it looks like changes are not being reflected or something. I restart the Docker container after changing those settings, but it's still there :/

#

I added: javascript:void(0)