Files
immich-folio/app/admin/layout.tsx

21 lines
791 B
TypeScript
Raw Normal View History

import type { Metadata } from 'next';
export const metadata: Metadata = {
title: 'Immich Folio Admin',
robots: { index: false, follow: false },
};
security: fix pre-auth bypasses and restore Immich 3.x compatibility (#378) Seven security issues from an audit, plus album pages and the map coming up empty against Immich 3.x. Verified against a real Immich 3.0.3 instance in a production build. Security: - Admin session forgery via a hardcoded 'dev-fallback-secret' signing key that bypassed the production AUTH_SECRET guard - /api/map ignored album passwords and returned working asset tokens; rewriting ?size=thumbnail to ?size=original downloaded full-resolution originals from protected albums - Admin login had no rate limit, and the client IP came from a spoofable header, so rotating it bypassed every limit in the app - Raw Immich asset UUIDs were serialized into the RSC payload - Album tokens never expired server-side; a captured token replayed forever - Path traversal into the Immich API via an unvalidated album id - /admin ran with no enforced CSP (only Report-Only reached it) TRUSTED_PROXIES is replaced by TRUSTED_PROXY_HOPS. The old variable matched proxy IPs against the socket peer address, which self-hosted Next.js never exposes, so the check could never pass: unset, the limiter read a spoofable header; set, every request shared one bucket and a single client could rate-limit the whole site. Migrates automatically. Immich 3.x: GET /albums/:id no longer embeds assets. Assets now come from POST /search/metadata with withExif: true — without that flag EXIF is omitted and grid aspect ratios, the lightbox panel and map markers stay empty. Drops support for Immich below 3.0, which now logs a warning. Upgrade: requires Immich 3.0+; set TRUSTED_PROXY_HOPS (nginx = 1); visitors of protected areas and admin sessions must log in once more. 91 unit tests (25 new); the new admin-auth and rate-limit cases were confirmed to fail against the pre-fix code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-20 18:57:57 +02:00
/**
* Required for the CSP nonce. The admin page is a pure client component, so
* Next.js would statically prerender it at build time — and a prerendered HTML
* file cannot carry the per-request nonce that middleware.ts issues. Since the
* CSP uses 'strict-dynamic' (which makes 'self' inert), unnonced script tags
* are blocked and the panel never hydrates. Rendering per request lets Next.js
* stamp the nonce onto the script tags it emits.
*/
export const dynamic = 'force-dynamic';
export default function AdminLayout({ children }: { children: React.ReactNode }) {
return <div className="admin-layout">{children}</div>;
}