fix: allow unauthenticated access to /login page #86

Merged

jonas.hanisch merged 1 commit from fix/login-page-json-response into main

2026-01-22 19:12:14 +00:00

jack commented

2026-01-22 19:08:49 +00:00

Owner

Summary

Fix redirect loop when accessing /login without authentication
Only enable auth middleware when BOTH non-localhost bind AND token configured
Allow /login and /api/auth/* paths to bypass auth checks
Log warning when network access is enabled without authentication

Problem

When binding to a non-localhost address without a remote token configured:

User visits / → redirected to /login
Login page redirects to / (no auth configured)
Infinite redirect loop

Solution

Auth middleware now only activates when both conditions are met:
- Bind address is not localhost
- CLAUDE_MEM_REMOTE_TOKEN is configured
If network access without auth, log warning but allow access

Test plan

Network access without token: works without login
Network access with token: login page loads correctly
Localhost access: always works

🤖 Generated with Claude Code

## Summary - Fix redirect loop when accessing `/login` without authentication - Only enable auth middleware when BOTH non-localhost bind AND token configured - Allow `/login` and `/api/auth/*` paths to bypass auth checks - Log warning when network access is enabled without authentication ## Problem When binding to a non-localhost address without a remote token configured: 1. User visits `/` → redirected to `/login` 2. Login page redirects to `/` (no auth configured) 3. Infinite redirect loop ## Solution - Auth middleware now only activates when **both** conditions are met: - Bind address is not localhost - `CLAUDE_MEM_REMOTE_TOKEN` is configured - If network access without auth, log warning but allow access ## Test plan - [x] Network access without token: works without login - [x] Network access with token: login page loads correctly - [x] Localhost access: always works 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jack added 1 commit

2026-01-22 19:08:49 +00:00

fix: allow unauthenticated access to /login page

CI / build (pull_request) Successful in 21s

Details

CI / validate-plugin (pull_request) Successful in 2s

Details

88c7787ebe

The auth middleware was blocking access to /login for remote users,
returning JSON instead of the login HTML page.

Changes:
- Allow /login and /api/auth/* paths before auth checks
- Only enable auth middleware when BOTH non-localhost bind AND token configured
- Log warning when network access enabled without authentication

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>