meleki/gott
1
0 Fork 0
Code Activity

fix: Telegram DELETE /webhook von Auth nicht mehr ausschließen

Browse Source 
AuthMiddleware hat /api/telegram/webhook komplett von der Auth
ausgeschlossen – unabhängig von der HTTP-Methode. Dadurch hatte
DELETE /api/telegram/webhook kein IsAdmin gesetzt → 403.

Fix: Nur POST auf diesen Pfad (= eingehender Telegram-Webhook)
wird von der Auth ausgenommen.
This commit is contained in:
Meleki committed 2026-03-03 09:12:13 +01:00
1 parent e5d76bb0a9
commit dc87bf802a
1 file changed
+2 -1
Download Patch File Download Diff File Expand all files Collapse all files
Middleware/AuthMiddleware.cs
+2 -1
View File
@@ -18,7 +18,8 @@ public class AuthMiddleware
var path = ctx.Request.Path.Value ?? ""; var path = ctx.Request.Path.Value ?? "";
// Static files, login and telegram webhook don't require auth // Static files, login and telegram webhook don't require auth
if (!path.StartsWith("/api/") || path == "/api/auth/login" || path == "/api/telegram/webhook") var isTelegramWebhook = path == "/api/telegram/webhook" && ctx.Request.Method == "POST";
if (!path.StartsWith("/api/") || path == "/api/auth/login" || isTelegramWebhook)
{ {
await _next(ctx); await _next(ctx);
return; return;