starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Toggleable /swagger, /windows and /apple endpoints #238

New Issue
Closed
opened 2025-12-29 01:24:41 +01:00 by adam · 11 comments
adam commented 2025-12-29 01:24:41 +01:00
Owner
Copy Link

Originally created by @reynico on GitHub (Mar 15, 2022).

👋 Hi!

Although /windows and /apple may not disclose a lot of data, I'm a bit worried about /swagger and its exposure open wide on the general listening port.

I'd suggest making these endpoints toggleable by configuration

Originally created by @reynico on GitHub (Mar 15, 2022). 👋 Hi! Although `/windows` and `/apple` may not disclose a lot of data, I'm a bit worried about `/swagger` and its exposure open wide on the general listening port. I'd suggest making these endpoints toggleable by configuration
adam added the enhancementwontfix labels 2025-12-29 01:24:41 +01:00
adam closed this issue 2025-12-29 01:24:41 +01:00
adam commented 2025-12-29 01:24:41 +01:00
Author
Owner
Copy Link

@restanrm commented on GitHub (Mar 17, 2022):

Is it to prevent from security vulnerabilities on the unmanaged swagger code ? Even though the API is here doesn't mean that anyone can manage the Headscale server. You would still need a valid APIKey.

@restanrm commented on GitHub (Mar 17, 2022): Is it to prevent from security vulnerabilities on the unmanaged swagger code ? Even though the API is here doesn't mean that anyone can manage the Headscale server. You would still need a valid APIKey.
adam commented 2025-12-29 01:24:42 +01:00
Author
Owner
Copy Link

@reynico commented on GitHub (Mar 17, 2022):

Hi!

Is it to prevent from security vulnerabilities on the unmanaged swagger code ?

more than that, I don't see any reason to have a swagger endpoint exposed open wide. (But I could be missing something here!)

@reynico commented on GitHub (Mar 17, 2022): Hi! > Is it to prevent from security vulnerabilities on the unmanaged swagger code ? more than that, I don't see any reason to have a swagger endpoint exposed open wide. (But I could be missing something here!)
adam commented 2025-12-29 01:24:43 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Mar 17, 2022):

I suppose it makes some overview of an attack surface visible.

However, I dont really want to start solving a problem with togglable endpoints for the sake of it.

What I think would be more sensible is to have it authenticated. I can imagine a solution were it is only available if you use oidc, and if oidc is enable, all those endpoints requires login.

I argue that if you don't use oidc, you run a small enough deployment that this does not matter.

@kradalby commented on GitHub (Mar 17, 2022): I suppose it makes some overview of an attack surface visible. However, I dont really want to start solving a problem with togglable endpoints for the sake of it. What I think would be more sensible is to have it authenticated. I can imagine a solution were it is _only_ available if you use oidc, and if oidc is enable, all those endpoints requires login. I argue that if you don't use oidc, you run a small enough deployment that this does not matter.
adam commented 2025-12-29 01:24:43 +01:00
Author
Owner
Copy Link

@reynico commented on GitHub (Mar 17, 2022):

it's a fair point. Is there any reason to have the swagger endpoint available open wide rather than on an internal network?

@reynico commented on GitHub (Mar 17, 2022): it's a fair point. Is there any reason to have the swagger endpoint available open wide rather than on an internal network?
adam commented 2025-12-29 01:24:44 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Mar 17, 2022):

Not particularly, but I assume it will run into the same issue as /metrics, implementing it isnt straight forward enough to bother (at least at the moment)

@kradalby commented on GitHub (Mar 17, 2022): Not particularly, but I assume it will run into the same issue as `/metrics`, implementing it isnt straight forward enough to bother (at least at the moment)
adam commented 2025-12-29 01:24:45 +01:00
Author
Owner
Copy Link

@reynico commented on GitHub (Mar 18, 2022):

I know this is not what makes you happy 😄 but in that case, why not just bring up another internal endpoint for /swagger?

@reynico commented on GitHub (Mar 18, 2022): I know this is not what makes you happy 😄 but in that case, why not just bring up another internal endpoint for `/swagger`?
adam commented 2025-12-29 01:24:45 +01:00
Author
Owner
Copy Link

@mannp commented on GitHub (Mar 21, 2022):

Not particularly, but I assume it will run into the same issue as /metrics, implementing it isn't straight forward enough to bother (at least at the moment)

Isn't an internal 'metrics' already implemented, could swagger be implemented in the same way, or is it more involved.

Out of interest, are these endpoints exposed for tailscale?

@mannp commented on GitHub (Mar 21, 2022): > Not particularly, but I assume it will run into the same issue as `/metrics`, implementing it isn't straight forward enough to bother (at least at the moment) Isn't an internal 'metrics' already implemented, could swagger be implemented in the same way, or is it more involved. Out of interest, are these endpoints exposed for tailscale?
adam commented 2025-12-29 01:24:46 +01:00
Author
Owner
Copy Link

@mpldr commented on GitHub (Apr 11, 2022):

Correct me if I'm wrong, but wouldn't it be easiest to just deny access (or blackhole) requests to these routes in the reverse proxy? Might be something worth documenting.

@mpldr commented on GitHub (Apr 11, 2022): Correct me if I'm wrong, but wouldn't it be easiest to just deny access (or blackhole) requests to these routes in the reverse proxy? Might be something worth documenting.
adam commented 2025-12-29 01:24:46 +01:00
Author
Owner
Copy Link

@routerino commented on GitHub (Jun 9, 2022):

Correct me if I'm wrong, but wouldn't it be easiest to just deny access (or blackhole) requests to these routes in the reverse proxy? Might be something worth documenting.

Yep. These days anything going outside an internal network (really anything going inside an internal network as well) should be gated behind a reverse proxy. Caddy could IP whitelist those endpoints easily. I think headscale (as a service) has done its due diligence by requiring authentication for the API, anything else is on the person securing it.

@routerino commented on GitHub (Jun 9, 2022): > Correct me if I'm wrong, but wouldn't it be easiest to just deny access (or blackhole) requests to these routes in the reverse proxy? Might be something worth documenting. Yep. These days *anything* going outside an internal network (really anything going inside an internal network as well) should be gated behind a reverse proxy. Caddy could IP whitelist those endpoints easily. I think headscale (as a service) has done its due diligence by requiring authentication for the API, anything else is on the person securing it.
adam commented 2025-12-29 01:24:46 +01:00
Author
Owner
Copy Link

@RUzOfuz5m commented on GitHub (Oct 16, 2022):

I was able to find all the endpoints by grep router.HandleFunc ./app.go and I'm curious what other endpoints can be closed to the public.

@RUzOfuz5m commented on GitHub (Oct 16, 2022): I was able to find all the endpoints by `grep router.HandleFunc ./app.go ` and I'm curious what other endpoints can be closed to the public.
adam commented 2025-12-29 01:24:46 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (May 10, 2023):

I will close this as wontfix, as we dont see the general need. There are ways to lock this down outside of headscale and it is currently out of scope.

@kradalby commented on GitHub (May 10, 2023): I will close this as wontfix, as we dont see the general need. There are ways to lock this down outside of headscale and it is currently out of scope.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label enhancement wontfix
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#238
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?