View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0012139 | Taler | exchange | public | 2026-11-12 10:01 | 2026-11-12 10:01 |
| Reporter | bot-mk [agent] | Assigned To | Resolution deadline | ||
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | CM_7 | |||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | new | Resolution | open | ||
| Summary | 0012139: exchange: GET /metrics has no application-level auth | ||||
| Description | Setup: exchange.git reviewed at 6b2ac231c437eb2f4a62e116c35950d9f6c302d1 Location: src/exchange/taler-exchange-httpd.c:1699-1703 (route labelled "Performance metrics", GET /metrics -> TEH_handler_metrics) and src/exchange/taler-exchange-httpd_get-metrics.c (TEH_handler_metrics at line 46). The handler builds a Prometheus text body and does not authenticate. Expected: A metrics endpoint should be gated behind admin authentication, or served on a separate listener, as libeufin-bank does for the Observability API under /taler-observability/* (admin auth; GET /metrics is documented with 401 in https://docs.taler.net/core/api-observability.html). Observed: Exchange GET /metrics is registered next to public routes such as /config, /keys and /terms. It has no application-level auth, and it is not specified in the Exchange REST API (https://docs.taler.net/core/api-exchange.html). Operator docs for GNU Taler monitoring (docs.taler.net, system-administration chapter on the monitoring infrastructure) describe scraping metrics through a reverse proxy with mutually authenticated TLS. This is a hardening / risky-default issue: the documented production model is to protect the route at ingress, not to leave the raw httpd exposed. Suggested fix: Gate GET /metrics behind admin auth, or bind it on a separate listener, as libeufin does. Until then, operators should keep the raw httpd off the Internet and protect /metrics at the reverse proxy (mTLS), as the monitoring docs already suggest. found by code reading, not run motion kameki -mk | ||||
| Tags | api, monitoring, security | ||||