aaronrene / knowtation public
canister-auth-headers.mjs
12 lines 558 B
Raw
sha256:700fafdd1afa490919f9515d660ca6e75456bcd5bb67513abcd8757a634c01f6 docs: record AIP-b SD-21 land (KN #308) Human 9 days ago
1 /**
2 * ICP canister HTTP expects X-Gateway-Auth matching canister `gateway_auth_secret`
3 * (see hub/icp `gatewayAuthorized` — SEC-KN-1 fail-closed: empty secret DENIES).
4 * The gateway proxy always merges this; direct fetch helpers must do the same.
5 * When CANISTER_AUTH_SECRET is empty, callers send no header and the canister returns
6 * GATEWAY_AUTH_REQUIRED on every protected route.
7 */
8 export function canisterAuthHeaders() {
9 const secret = process.env.CANISTER_AUTH_SECRET || '';
10 if (!secret) return {};
11 return { 'x-gateway-auth': secret };
12 }
File History 1 commit
sha256:700fafdd1afa490919f9515d660ca6e75456bcd5bb67513abcd8757a634c01f6 docs: record AIP-b SD-21 land (KN #308) Human 9 days ago