From 3eecca35cea40b460f4144292a4557ace472a76d Mon Sep 17 00:00:00 2001 From: dtzp555 Date: Sat, 11 Apr 2026 10:09:07 +1000 Subject: [PATCH] feat: localhost bypass auth in multi mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Requests from 127.0.0.1/::1 skip authentication even in multi/shared auth modes. Only remote (LAN) clients need API keys. This simplifies local tool integration — IDEs and agents on the same machine no longer need to configure Bearer tokens. Co-Authored-By: Claude Opus 4.6 --- server.mjs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/server.mjs b/server.mjs index 458f791..23c3d8b 100644 --- a/server.mjs +++ b/server.mjs @@ -1041,10 +1041,12 @@ const server = createServer(async (req, res) => { // 3-mode auth: none | shared | multi const pathname = req.url.split("?")[0]; const isPublicEndpoint = pathname === "/health" || pathname === "/dashboard"; - let authKeyName = "local"; + const remoteAddr = req.socket.remoteAddress || ""; + const isLocalhost = remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1"; + let authKeyName = isLocalhost ? "local" : "remote"; let authKeyId = null; - if (!isPublicEndpoint) { + if (!isPublicEndpoint && !isLocalhost) { const auth = req.headers["authorization"] || ""; const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";