From 08a4f138e3eb2ad85dce1b31f3899881a0e02de2 Mon Sep 17 00:00:00 2001 From: richjohnrambo Date: Fri, 28 Aug 2026 11:28:28 +0800 Subject: [PATCH] fix: skip nonce replay check for internal reads --- server/internal_api.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/server/internal_api.go b/server/internal_api.go index 4938778..4a6bf04 100644 --- a/server/internal_api.go +++ b/server/internal_api.go @@ -185,10 +185,12 @@ func authorizeInternalAPI(wrt http.ResponseWriter, req *http.Request, capability writeIMError(wrt, req, http.StatusUnauthorized, 30043, imReasonAuthRequired, "invalid internal signature", nil) return false } - requestClaim := internalRequestClaimValue(signingText) - if !claimInternalNonce(serviceName, nonce, requestClaim, time.Now().Add(window)) { - writeIMError(wrt, req, http.StatusUnauthorized, 30043, imReasonAuthRequired, "internal nonce replayed", nil) - return false + if req.Method != http.MethodGet { + requestClaim := internalRequestClaimValue(signingText) + if !claimInternalNonce(serviceName, nonce, requestClaim, time.Now().Add(window)) { + writeIMError(wrt, req, http.StatusUnauthorized, 30043, imReasonAuthRequired, "internal nonce replayed", nil) + return false + } } return true }