windmill

mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-21 16:02:28 +00:00

Files

T

Ruben Fiszel 7ec56ef619 fix: require auth on GET /concurrency_groups/{job_id}/key (#10221 )

The /concurrency_groups global service is registered after the router's
.route_layer(from_extractor::<ApiAuthed>()), and Axum's route_layer only
wraps routes present at the call site, so this handler was left with no
router-level auth. Unlike its siblings list_concurrency_groups and
prune_concurrency_group, get_concurrency_key declared no ApiAuthed
parameter, so GET /api/concurrency_groups/{job_id}/key was reachable
unauthenticated and would return concurrency keys (which can embed
workspace ids, script/flow paths, and $args-templated argument values)
for arbitrary jobs instance-wide.

Add _authed: ApiAuthed so the extractor independently enforces
authentication regardless of layer placement, matching the
defense-in-depth pattern of the sibling handlers.

Fixes WIN-2212

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-21 07:08:16 +02:00

concurrency_groups.rs

fix: require auth on GET /concurrency_groups/{job_id}/key (#10221 )

2026-07-21 07:08:16 +02:00

execution.rs

feat(triggers): serve binary HTTP-route responses via base64 transfer encoding (#10058 )

2026-07-12 10:26:55 +02:00

job_metrics.rs

tighten security from vuln report (#9264 )

2026-05-20 14:02:50 +00:00

jobs_export.rs

feat: cap queued jobs per concurrency key on cloud (#10197 )