diegosouzapw f9e799d089 fix(security): harden management API auth and openapi try proxy ...

Require management authentication across combo, settings, skill,
webhook, provider auth, restart, and shutdown management routes to
prevent unauthenticated access to privileged operations.

Tighten the OpenAPI try endpoint to only proxy same-origin OmniRoute API
paths and strip hop-by-hop or forwarded headers before dispatching.
Add unit coverage for the new auth guards and proxy validation rules.

2026-04-25 16:45:59 -03:00

4.6 KiB

Raw Blame History

View Raw