From d62e57071f2afb83879f576f6a3af5ecaa21023b Mon Sep 17 00:00:00 2001 From: omnom62 Date: Wed, 12 Aug 2026 14:38:00 +1000 Subject: http-api: T8989: address review comments - Make ApiModel.key optional to allow Bearer/X-API-Key/mTLS auth without requiring a dummy key field in the request body - Add thread safety to REST token secret initialization - Cast rest_token_exp and rest_secret_len to int on load - Use defensive dict.get() for authentication config access --- src/services/vyos-http-api-server | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'src/services/vyos-http-api-server') diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server index 4039d17a2..bdcf24e39 100755 --- a/src/services/vyos-http-api-server +++ b/src/services/vyos-http-api-server @@ -184,9 +184,13 @@ def initialization(session: SessionState, app: FastAPI = app): rest_config = server_config.get('rest', {}) session.debug = bool('debug' in rest_config) session.strict = bool('strict' in rest_config) - if isinstance(rest_config, dict) and 'authentication' in rest_config: - session.rest_token_exp = rest_config['authentication']['expiration'] - session.rest_secret_len = rest_config['authentication']['secret_length'] + if isinstance(rest_config, dict): + auth = rest_config.get('authentication', {}) + if isinstance(auth, dict): + if 'expiration' in auth: + session.rest_token_exp = int(auth['expiration']) + if 'secret_length' in auth: + session.rest_secret_len = int(auth['secret_length']) graphql_config = server_config.get('graphql', {}) session.origins = graphql_config.get('cors', {}).get('allow_origin', []) -- cgit v1.2.3