From af1f23466c46bf4cebc42ab1687552b1a4baafd5 Mon Sep 17 00:00:00 2001 From: yyamashita Date: Fri, 19 Jun 2026 23:31:30 +0900 Subject: Separate API_TOKEN from REGISTER_TOKEN REGISTER_TOKEN: passkey registration only API_TOKEN: POST /api/posts authentication Co-Authored-By: Claude Sonnet 4.6 --- app/routes/api.posts.tsx | 2 +- docker-compose.yml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/app/routes/api.posts.tsx b/app/routes/api.posts.tsx index 8ef7639..ea86365 100644 --- a/app/routes/api.posts.tsx +++ b/app/routes/api.posts.tsx @@ -14,7 +14,7 @@ export async function action({ request }: Route.ActionArgs) { return Response.json({ error: "Method not allowed" }, { status: 405 }); } - const token = process.env.REGISTER_TOKEN; + const token = process.env.API_TOKEN; const auth = request.headers.get("Authorization") ?? ""; if (!token || auth !== `Bearer ${token}`) { return Response.json({ error: "Unauthorized" }, { status: 401 }); diff --git a/docker-compose.yml b/docker-compose.yml index b617cbc..8fbf296 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -13,6 +13,7 @@ services: - DB_PATH=/app/data/microblog.db - SESSION_SECRET=${SESSION_SECRET} - REGISTER_TOKEN=${REGISTER_TOKEN} + - API_TOKEN=${API_TOKEN} - WEBAUTHN_RP_ID=blog.yyamashita.com - WEBAUTHN_ORIGIN=https://blog.yyamashita.com restart: unless-stopped -- cgit v1.2.3