Operational: Admin UI binary has no authentication of its own #89

New issue

Open

opened 2026-05-11 13:48:52 +00:00 by thabeta · 0 comments

thabeta commented

2026-05-11 13:48:52 +00:00

Owner

Severity: High

Location

crates/hero_aibroker_admin/src/main.rs

Finding

The admin UI binary (hero_aibroker_admin) serves an HTML dashboard with no authentication:

No login page
No token validation
No session management
Proxies REST calls to rest.sock without adding auth headers

Anyone who can access the admin socket (or if the admin socket is exposed via TCP) gets full admin dashboard access.

Recommendation

Add authentication to the admin UI (token-based or JWT)
Proxy auth headers from the main broker's auth system
At minimum: require HERO_SECRET or ADMIN_TOKEN env var

## Severity: High ## Location `crates/hero_aibroker_admin/src/main.rs` ## Finding The admin UI binary (`hero_aibroker_admin`) serves an HTML dashboard with no authentication: - No login page - No token validation - No session management - Proxies REST calls to `rest.sock` without adding auth headers Anyone who can access the admin socket (or if the admin socket is exposed via TCP) gets full admin dashboard access. ## Recommendation - Add authentication to the admin UI (token-based or JWT) - Proxy auth headers from the main broker's auth system - At minimum: require `HERO_SECRET` or `ADMIN_TOKEN` env var