Skip to content

feat(cliproxyapi): enable api-keys authentication on Linux only #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 3 commits into from
Dec 28, 2025
Merged

feat(cliproxyapi): enable api-keys authentication on Linux only #461

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c0b61b8
feat(cliproxyapi): enable api-keys authentication on Linux only
shunkakinoki Dec 28, 2025
46dae4e
test(cliproxyapi): add tests for platform-specific api-keys handling
shunkakinoki Dec 28, 2025
fceb681
fix: rename jobs in shell workflow for clarity and correct execution …
shunkakinoki Dec 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion config/cliproxyapi/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ remote-management:
auth-dir: "~/.cli-proxy-api"
# API keys for client authentication (optional - leave commented for open access)
# api-keys:
# - "your-api-key"
# - "__CLIPROXY_API_KEY__"

# Enable debug logging
debug: true
Expand Down
9 changes: 9 additions & 0 deletions home-manager/services/cliproxyapi/scripts/start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,15 @@ if [ -f "$TEMPLATE" ]; then
-e "s|__ZAI_API_KEY__|${ZAI_API_KEY:-}|g" \
-e "s|__AMP_UPSTREAM_API_KEY__|${AMP_UPSTREAM_API_KEY:-}|g" \
"$TEMPLATE" >"$CONFIG"

# Linux: uncomment and enable api-keys for client authentication
# macOS: leave api-keys commented for open access
if [ "$(uname)" = "Linux" ]; then

@cubic-dev-ai cubic-dev-ai Bot Dec 28, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: The API key authentication is enabled unconditionally on Linux without checking if CLIPROXY_API_KEY is actually set. When the environment variable is empty or unset, the config will contain api-keys: [""], which could either lock out all clients (if empty keys are rejected) or create a security vulnerability (if empty keys are accepted). Add a check for a non-empty key value before enabling authentication.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At home-manager/services/cliproxyapi/scripts/start.sh, line 74:

<comment>The API key authentication is enabled unconditionally on Linux without checking if `CLIPROXY_API_KEY` is actually set. When the environment variable is empty or unset, the config will contain `api-keys: [&quot;&quot;]`, which could either lock out all clients (if empty keys are rejected) or create a security vulnerability (if empty keys are accepted). Add a check for a non-empty key value before enabling authentication.</comment>

<file context>
@@ -68,6 +68,15 @@ if [ -f &quot;$TEMPLATE&quot; ]; then
+
+  # Linux: uncomment and enable api-keys for client authentication
+  # macOS: leave api-keys commented for open access
+  if [ &quot;$(uname)&quot; = &quot;Linux&quot; ]; then
+    @sed@ -i \
+      -e &quot;s|^# api-keys:|api-keys:|&quot; \
</file context>
Suggested change
if [ "$(uname)" = "Linux" ]; then
if [ "$(uname)" = "Linux" ] && [ -n "${CLIPROXY_API_KEY:-}" ]; then
Fix with Cubic

@sed@ -i \
-e "s|^# api-keys:|api-keys:|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"${CLIPROXY_API_KEY:-}\"|" \

@cursor cursor Bot Dec 28, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Empty API key enabled when environment variable unset

When CLIPROXY_API_KEY is not set or empty, the substitution ${CLIPROXY_API_KEY:-} results in an empty string being configured as a valid API key. On Linux, this produces a config with api-keys: [""], meaning the authentication system is enabled but with an empty string as the only valid key. Depending on how cliproxyapi validates API keys, this could either allow authentication with an empty API key header (security bypass) or block all legitimate requests (service outage). The script unconditionally uncomments the api-keys section without verifying the environment variable is set and non-empty.

Fix in Cursor Fix in Web

"$CONFIG"
Comment on lines +74 to +78

@chatgpt-codex-connector chatgpt-codex-connector Bot Dec 28, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Guard against empty CLIPROXY_API_KEY on Linux

On Linux this block always uncomments api-keys and substitutes ${CLIPROXY_API_KEY:-}; when the env var is unset (e.g., missing .env in a systemd context), the config becomes api-keys: [""]. Depending on CLIProxyAPI’s auth logic, that either locks out all clients (no one has an empty key) or unintentionally allows empty-key access if a missing header is treated as "". To avoid surprising outages or false security, only enable the section when the key is non-empty or fail fast if it’s required.

Useful? React with 👍 / 👎.

fi
Comment on lines +72 to +79

@gemini-code-assist gemini-code-assist Bot Dec 28, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This block has two significant issues:

  1. Empty API Key: It enables API key authentication even if CLIPROXY_API_KEY is empty. This will result in api-keys: [ "" ] in the configuration, which could be a security risk (allowing access with an empty key) or cause the service to fail if an empty key is invalid. Authentication should only be enabled when a valid key is present.

  2. sed Injection Vulnerability: The sed command is vulnerable to script injection. If CLIPROXY_API_KEY contains characters that are special to sed's replacement string (e.g., the delimiter |, &, or \), the shell expansion will break the sed command or corrupt the key in the config file. This can prevent the service from starting.

Here is a more robust implementation that addresses both points by first checking for a non-empty key and then safely escaping it before substitution.

Suggested change
# Linux: uncomment and enable api-keys for client authentication
# macOS: leave api-keys commented for open access
if [ "$(uname)" = "Linux" ]; then
@sed@ -i \
-e "s|^# api-keys:|api-keys:|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"${CLIPROXY_API_KEY:-}\"|" \
"$CONFIG"
fi
# Linux: uncomment and enable api-keys for client authentication
# macOS: leave api-keys commented for open access
if [ "$(uname)" = "Linux" ] && [ -n "${CLIPROXY_API_KEY:-}" ]; then
# Escape characters that are special to sed's replacement string: &, \, and the delimiter |
safe_api_key=$(printf '%s' "$CLIPROXY_API_KEY" | @sed@ -e 's/[&|\\]/\\&/g')
@sed@ -i \
-e "s|^# api-keys:|api-keys:|" \
-e "s|^# - \"__CLIPROXY_API_KEY__\"| - \"$safe_api_key\"|" \
"$CONFIG"
fi

# Also copy to objectstore config location (cliproxyapi uses this for persistence)
mkdir -p "$CONFIG_DIR/objectstore/config"
cp "$CONFIG" "$CONFIG_DIR/objectstore/config/config.yaml"
Expand Down
Loading