Remove API key auth; CORS is sufficient.

The React UI running in a browser can't connect to the backend without
punching a hole for CORS, which isn't done by default. We don't need the
API key to protect from browsers, and anything else running on the
user's machine that can access the backend (that's hosted on only
localhost) already has enough control to do damage without using
Liberation as an attack vector.

https://github.com/dcs-liberation/dcs_liberation
This commit is contained in:
Dan Albert
2022-03-06 01:57:12 -08:00
parent 8165d3bd8c
commit 904602510d
4 changed files with 4 additions and 23 deletions

View File

@@ -23,7 +23,6 @@ from game.debriefing import Debriefing
from game.layout import LAYOUTS
from game.server import EventStream, GameContext
from game.server.dependencies import QtCallbacks, QtContext
from game.server.security import ApiKeyManager
from game.theater import ControlPoint, MissionTarget, TheaterGroundObject
from qt_ui import liberation_install
from qt_ui.dialogs import Dialog
@@ -116,8 +115,6 @@ class QLiberationWindow(QMainWindow):
else:
self.onGameGenerated(self.game)
logging.debug(f"API Key: {ApiKeyManager.KEY}")
def initUi(self):
hbox = QSplitter(Qt.Horizontal)
vbox = QSplitter(Qt.Vertical)