sub2api

mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-10-15 23:22:59 +08:00

Files

T

Cheri Wen 11b6017171 fix: return 404 instead of 403 for unauthorized key access to prevent ID oracle (CWE-204)

GET /api/v1/keys/:id previously returned distinct HTTP status
codes for 'key not found' (404) vs 'key exists but belongs to
another user' (403). This oracle allowed attackers to enumerate
valid API key IDs by observing response differences.

Now returns 404 in both cases so the response is identical
regardless of whether a key exists.

Fixes: CWE-204 (Information Disclosure via ID Oracle)

2026-06-02 00:46:50 +08:00

cmd

Merge pull request #2881 from xiaoyiluck666/fix/openai-oauth-refresh-enrichment

2026-06-01 10:04:16 +08:00

ent

feat(group): 支持自定义 /v1/models 模型列表

2026-05-27 18:00:45 +08:00

internal

fix: return 404 instead of 403 for unauthorized key access to prevent ID oracle (CWE-204)

2026-06-02 00:46:50 +08:00

migrations

feat: 适配 claude-opus-4-8