Repository navigation
API key: an empty value silently disables authentication, and the key is compared with == #213
Description
Two small hardening points in the API key check (serve/server.py#L1243-L1251):
- An empty key turns authentication off, silently on 127.0.0.1.
--api-keydefaults to$STRATA_API_KEY(#L1669-L1670), and an empty value falls back to the config'sapi_key(#L1727); when both are empty,_authorized()lets every request through. The "no API key" warning is printed only for other hosts (#L1752-L1761); on 127.0.0.1 the ready line just leaves out ", API key required". A launcher that meant to set a key but exported an emptySTRATA_API_KEYgets an open server and no sign of it. - The key is compared with
==(given == svc.api_key), which is not a constant-time comparison.hmac.compare_digest(given.encode(), svc.api_key.encode())is the usual replacement.
Suggested: refuse to start, or at least warn on every host, when --api-key or STRATA_API_KEY is given but empty, and compare with hmac.compare_digest.
Activity
Niko1221 commentedon Sep 30, 2026
Good points. 0.1.28 (in testing) compares the key in constant time (
hmac.compare_digest), and an explicitly empty key (--api-key ""or an emptySTRATA_API_KEY) stops the server with a message instead of switching authentication off.server: /status needs the API key and forgets the answer's end (#212)…
Niko1221 commentedon Sep 30, 2026
Fixed in 0.1.28: constant-time comparison (
hmac.compare_digest), and an explicitly empty key (--api-key ""or an emptySTRATA_API_KEY) stops the server with a message.server: /status needs the API key and forgets the answer's end (Niko1…
server: /status needs the API key and forgets the answer's end (Niko1…
Merge upstream main (30ec18e, engine 0.1.30): the server's GPU sharin…
serve, setup: an empty API key in the config or from setup --api-key …
server: /status needs the API key and forgets the answer's end (Niko1…
server: /status needs the API key and forgets the answer's end (Niko1…
serve: an empty api_key in the config is a warning at start, not sile…
serve: an empty api_key in the config is a warning at start, not sile…
host: a model the host starts from a source checkout gets no empty ST…