cmd: require auth for debug endpoints

SiaFoundation · Nov 16, 2023 · afc9e12 · afc9e12
1 parent 8e7f223
commit afc9e12
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/cmd/hostd/web.go b/cmd/hostd/web.go
@@ -17,6 +17,11 @@ func (wr webRouter) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		req.URL.Path = strings.TrimPrefix(req.URL.Path, "/api") // strip the prefix
 		wr.api.ServeHTTP(w, req)
 	case strings.HasPrefix(req.URL.Path, "/debug/pprof"):
+		_, password, ok := req.BasicAuth()
+		if !ok || password != cfg.HTTP.Password {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
 		http.DefaultServeMux.ServeHTTP(w, req)
 	default:
 		wr.ui.ServeHTTP(w, req)