fix(browser-bridge): auth bypass when secret empty, popup status fix, force ping on open

2026-06-09 00:44:51 +08:00
parent 58751945eb
commit fa5001341e
7 changed files with 134 additions and 4095 deletions
@@ -239,6 +239,11 @@ func (s *Server) handleEvents(w http.ResponseWriter, r *http.Request) {
 // withAuth wraps a handler with shared-secret authentication.
 func (s *Server) withAuth(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		// If no secret is configured, skip authentication
+		if s.secret == "" {
+			next(w, r)
+			return
+		}
 		auth := r.Header.Get("X-Verstak-Secret")
 		if auth != s.secret {
 			http.Error(w, "unauthorized", 401)