fix(lightning): send the LNbits api key as X-Api-Key header instead of query param#208
Merged
Merged
Conversation
…f query param The admin/wallet keys were landing in plain text in the LNbits access log on every lnurlp/lnurlw/payments call. LNbits reads X-Api-Key on the same endpoints, so the key moves to the header and the boltcards URL drops its redundant copy. Ports DFXswiss/api#4225 to this repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every server-side LNbits call (
/lnurlp/{id},/lnurlp/api/v1/lnurl/cb/{id},POST /api/v1/payments, boltcards, lnurlw) passes the admin/wallet key as an?api-key=query parameter, so the keys land in plain text in the LNbits access log onlds-lnbits-1:DFXswiss/api fixed the same pattern in DFXswiss/api#4225 (released to prod today); after that release this repo is the only remaining source of
api-key=lines in the access log, and the planned key rotation is blocked until it stops being re-logged.Change
httpLnBitsConfigsends the key as anX-Api-Keyheader (LNbits reads header and query param interchangeably) instead of a query param — this covers all call sites, since every LNbits request routes through this helper.getBoltcardsdrops the redundant literal&api-key=from its URL; the config already carries the key.Verification
npm run check(eslint + jest): 5 suites, 30 tests green.lds-lnbits-1access log should show zero newapi-key=lines → then rotate the LNbits keys (old values persist in historical logs).