Cross-Origin Bearer API Authentication by korbin · Pull Request #1133 · bitaxeorg/ESP-Miner

korbin · 2025-07-05T23:46:06Z

This PR:

Adds mDNS service advertisement and discovery for bitaxe hostnames
Suggests a suffixed hostname (based on the station MAC) for new Bitaxe setups
Adds an NVS field, constant-time comparison functions, and corresponding frontend form fields for an API Secret token
Adds Swarm support for scanning and adding cross-origin Bitaxes locally
- Proxies Swarm local network scanning via mDNS service discovery through the currently-connected backend Bitaxe to avoid CORS issues
Reworks and simplifies all CORS logic:
- All cross-origin requests must present an Authorization: Bearer header as well as the X-Requested-With header (see OWASP)
- We no longer attempt to nor need determine which network the requester belongs to for cross-origin request safety.
Exposes current IP/subnet on the info endpoint

This has a number of advantages:

Hostname-based now access works in many standard scenarios: port forwarding, nginx, Cloudflare tunnels, VPNs, Tailscale, etc.
Swarm continues to work fairly seamlessly
Cross-origin API requests are now authenticated (this can easily be adapted to make all requests authenticated.)
Centralized UIs (just HTML pages) can be hosted (think GitHub Pages) and safely access local user Bitaxes (optional)

skot · 2025-07-06T12:01:44Z

This sounds amazing. I'll check it out as soon as I can.

Is authentication on needed for API / Swarm use? ie grandma doesn't have to set it up just to run a Bitaxe?

korbin · 2025-07-06T16:12:45Z

This sounds amazing. I'll check it out as soon as I can.

Is authentication on needed for API / Swarm use? ie grandma doesn't have to set it up just to run a Bitaxe?

No authentication is needed for any part of this (maintaining this theme for better or worse) except for cross-origin requests, which now all require an API token to be set.

Most users will not be making cross-origin requests unless they are using Swarm. If a user is using Swarm, the automatic scan-for-devices feature (visibly) works as it does currently, manually-added devices will require copying/pasting or typing whatever API secret the user chooses (or generates) into the Swarm UI.

korbin · 2025-07-07T06:54:25Z

I added the mDNS service discovery and ripped out the iterating scan loop (can overwhelm the ESP32, is slow, etc.), it's super slick:

https://github.com/korbin/ESP-Miner/tree/mdns-discovery
korbin@8228c70

~~I haven't merged it into this branch because this is something folks should test first - it's way nicer though.~~

You can fake a bitaxe in Linux with:

avahi-publish -s "fake-bitaxe" _bitaxe._tcp 80 "apiSecret=secretpass123"

You can scan for fake or real bitaxes using:

avahi-browse -rt _bitaxe._tcp

I added a new service: _bitaxe._tcp which has the API secret as a TXT record. The scan endpoint fetches all of these devices from the network using multicast and passes this information along to the frontend.

korbin · 2025-07-08T06:44:23Z

Update: I merged the mdns-discovery branch back into this one - it's working more consistently than the ESP32 port scan.

STSMiner1 · 2025-07-08T12:22:35Z

This needs the conflicts resolved.

…functionality to frontend/nvs, move swarm scan functionality to backend, remove local network checks

…validation

…patibility

mutatrum

Code level review with some smallish remarks. Would be really nice to get this added, IMO.

mutatrum · 2025-09-05T08:55:03Z

.github/workflows/build.yml

        target: esp32s3
-        command: GITHUB_ACTIONS="true" idf.py build
+        command: |
+          GITHUB_ACTIONS="true" idf.py add-dependency "espressif/mdns^1.8.2"


Is this needed if it's already added in the root CMakeLists.txt?

mutatrum · 2025-09-05T08:56:06Z

.github/workflows/unittest.yml


 jobs:
-  build-and-test:
+  build:


Should these changes on the tests be in a separate PR?

mutatrum · 2025-09-05T08:57:22Z

main/http_server/axe-os/src/app/components/network-edit/network.edit.component.html

+                        pTooltip="Generate random API secret"
+                        tooltipPosition="left"></p-button>
+                </div>
+                <small class="block mt-1">Optional 12-32 character string for API authentication</small>


Add to documentation.

mutatrum · 2025-09-05T08:58:47Z

main/http_server/axe-os/src/app/components/network-edit/network.edit.component.ts

      });
  }

+  private generateSuggestedHostname(macAddr: string): string {


This looks similar to the Wi-Fi AP name generation, is that the same?

mutatrum · 2025-09-05T09:00:31Z

main/http_server/axe-os/src/app/components/swarm/swarm.component.ts

      case 'Supra':      return 'blue';
      case 'UltraHex':   return 'orange';
      case 'Gamma':      return 'green';
+      case 'GammaHex':   return 'lime'; // New color?


Not needed, devices give their own color, this is only used for adding old firmware versions to swarm.

eandersson · 2025-09-21T12:10:43Z

Can you rebase this PR and remove all unnecessary changes e.g. unrelated CI changes or formatting changes.

WantClue · 2025-10-06T17:00:25Z

@korbin peek please again

mutatrum · 2025-12-05T13:29:42Z

There's also #1240. To limit the scope, would it make sense to merge that in first, and when mDNS is in place, do the auth as a smaller PR?

duckaxe mentioned this pull request Jul 7, 2025

Dashboard warning "Use IP address to access AxeOS" #1124

Closed

korbin force-pushed the cross-origin-api-auth branch from 7ece378 to e8244da Compare July 8, 2025 06:42

korbin marked this pull request as ready for review July 8, 2025 06:45

korbin added 10 commits July 10, 2025 12:10

add mDNS hostname advertisement

a4d4124

temp: try adding mdns dependency from component manager in ci

702471f

add bearer token authentication for cross-origin requests, add token …

2e6e032

…functionality to frontend/nvs, move swarm scan functionality to backend, remove local network checks

dont auth check preflight requests

45cb2b3

respond to all OPTIONS requests

ae224ce

fix swarm scan, improve swarm ui, improve swarm device deduplication/…

90afb54

…validation

switch swarm scan to use mDNS service discovery

110a57d

dont send X-Requested-With without an apiSecret to keep backwards com…

6e675eb

…patibility

fix swarm edit form api calls

252ca5d

add *this* device to swarm when auto-scanning

b781882

korbin force-pushed the cross-origin-api-auth branch from e8244da to b781882 Compare July 10, 2025 18:14

mutatrum reviewed Sep 5, 2025

View reviewed changes

mutatrum added this to the 2.11.0 milestone Sep 5, 2025

mutatrum mentioned this pull request Sep 18, 2025

feat: Add mDNS support for network discovery and dynamic hostname updates #1240

Open

WantClue removed this from the 2.11.0 milestone Oct 6, 2025

Comments

Conversation

korbin commented Jul 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skot commented Jul 6, 2025

Uh oh!

korbin commented Jul 6, 2025

Uh oh!

korbin commented Jul 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

korbin commented Jul 8, 2025

Uh oh!

STSMiner1 commented Jul 8, 2025

Uh oh!

mutatrum left a comment

Choose a reason for hiding this comment

Uh oh!

mutatrum Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

mutatrum Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

mutatrum Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

mutatrum Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

mutatrum Sep 5, 2025

Choose a reason for hiding this comment

Uh oh!

eandersson commented Sep 21, 2025

Uh oh!

WantClue commented Oct 6, 2025

Uh oh!

mutatrum commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

korbin commented Jul 5, 2025 •

edited

Loading

korbin commented Jul 7, 2025 •

edited

Loading