Ensembia/invoiceninja5_ynh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove API_SECRET from .env template to restore web UI login

Browse Source 
When API_SECRET is set, Invoice Ninja requires the X-API-SECRET header
on ALL API calls including /api/v1/login. The web UI (React SPA) never
sends this header, so browser login silently fails with "Invalid secret"
while the mobile app (which can be configured with the secret) continues
to work.

UPDATE_SECRET serves a different purpose (protecting the /update endpoint)
and is kept. API_SECRET should remain unset for self-hosted YunoHost installs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Dillard Blom
2026-07-06 16:34:09 +02:00
parent a59cb4ead3
commit fa89f4312d
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/default.env
+2 -1
View File
@@ -57,7 +57,8 @@ PHANTOMJS_KEY='__PHANTOMJS_KEY__'
PHANTOMJS_SECRET=__APP_KEY__ PHANTOMJS_SECRET=__APP_KEY__
UPDATE_SECRET=__API_SECRET__ UPDATE_SECRET=__API_SECRET__
API_SECRET=__API_SECRET__ # API_SECRET is intentionally not set: when set, it requires the X-API-SECRET header
# on ALL API calls including the web UI login (React SPA), which breaks browser login.
PRECONFIGURED_INSTALL=true PRECONFIGURED_INSTALL=true