From 86d6b45fbd53e31bbcbcb2ab205b8292dd69a587 Mon Sep 17 00:00:00 2001 From: Vlatko Kosturjak Date: Sat, 25 Jul 2026 18:40:44 +0200 Subject: [PATCH] fix(proxy): make OCS capabilities endpoint unprotected Anonymous/unauthenticated clients need to read /ocs/v[12].php/cloud/ capabilities before they've ever authenticated -- it's how a client discovers server capabilities, including auth-related ones, in the first place. It fell through to the general /ocs/ policy route, which requires auth, so anonymous requests got a 401 instead of the (public-safe) capabilities payload. Mirrors the existing precedent for /ocs/v[12].php/config a few lines above, which already carries Unprotected: true for the same reason. --- services/proxy/pkg/config/defaults/defaultconfig.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/services/proxy/pkg/config/defaults/defaultconfig.go b/services/proxy/pkg/config/defaults/defaultconfig.go index e3f2e380c5..07fab554f0 100644 --- a/services/proxy/pkg/config/defaults/defaultconfig.go +++ b/services/proxy/pkg/config/defaults/defaultconfig.go @@ -172,6 +172,18 @@ func DefaultPolicies() []config.Policy { Service: "eu.opencloud.web.frontend", Unprotected: true, }, + { + // Capabilities must be readable by anonymous/unauthenticated + // clients: it's how a client discovers server capabilities + // (including auth-related ones) before it has ever + // authenticated. Without this, the general /ocs/ route below + // requires auth, and anonymous capabilities requests 401 + // instead of returning the (public-safe) capabilities payload. + Type: config.RegexRoute, + Endpoint: "/ocs/v[12].php/cloud/capabilities", + Service: "eu.opencloud.web.frontend", + Unprotected: true, + }, // OCM WAYF public endpoints { Endpoint: "/sciencemesh/federations",