mrchatam bdd351bd15 fix(api): return 401 for invalid Bearer token instead of 404 (#6459) ...

When Authorization: Bearer is present but does not match (or is disabled),
respond with 401 Unauthorized so script authors can distinguish auth failure
from a wrong webBasePath. Requests with no Authorization header still get
404 masking; wrong base paths continue to 404 via NoRoute.

Fixes #6255

Co-authored-by: mrchatam <mrchatam@users.noreply.github.com>

2026-09-12 11:52:15 +02:00

..

amneziawg

fix(amneziawg): honor inbound listen when binding UDP socket (#6461)

2026-09-12 11:11:02 +02:00

amneziawgnet

fix(amneziawg): honor inbound listen when binding UDP socket (#6461)

2026-09-12 11:11:02 +02:00

config

v3.7.0

2026-08-24 15:07:15 +02:00

crypto/nodetoken

feat(pia): add PIA login-and-add WireGuard outbounds (#6272)

2026-08-22 23:11:06 +02:00

database

fix(inbounds): allow negative subSortIndex for subscription order (#6465)

2026-09-12 11:14:53 +02:00

eventbus

chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms

2026-07-25 16:08:09 +02:00

logger

fix(inbounds): apply runtime changes after the DB commit (#5768)

2026-07-08 22:12:28 +02:00

mtproto

fix(mtproto): synchronize child-process lifecycle (#6141)

2026-07-29 20:56:26 +02:00

pia

chore(build): bump Go toolchain to 1.27.0

2026-08-23 21:57:03 +02:00

sub

fix(inbounds): serve fresh client UUIDs for list and allLinks (#6458)

2026-09-12 11:12:13 +02:00

tuic

fix(tuic): evict the oldest relay flow instead of refusing new clients

2026-09-12 10:40:41 +02:00

tunnelmonitor

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

util

fix(link): map vcn to verifyPeerCertByName in applySecurity (#6479)

2026-09-12 11:04:10 +02:00

web

fix(api): return 401 for invalid Bearer token instead of 404 (#6459)

2026-09-12 11:52:15 +02:00

xray

docs(api): align OpenAPI with runtime contracts (#6409)

2026-09-04 15:23:41 +02:00