opensource/mateclaw
2
0
Fork 0
mirror of https://gitee.com/mateos/mateclaw.git synced 2026-09-13 11:13:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs(security): correct generated-file TTL comment (7 days, not 10 min)

Browse Source 
The permitAll comment claimed a 10-minute TTL, but GeneratedFileCache.TTL
is 7 days. The stale figure could mislead future security reasoning about
how long an unauthenticated capability URL stays live. Align the comment
with the actual value; the unguessable UUID remains the access guard.

Refs matevip/mateclaw#344
This commit is contained in:
倪程伟 2026-06-17 21:45:36 +08:00 committed by matevip
parent 7f4c62c3d6
commit 8e339f083a
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
mateclaw-server/src/main/java/vip/mate/config/SecurityConfig.java
View File

@ -62,7 +62,9 @@ public class SecurityConfig {
"/api/v1/channels/webhook/**",
"/api/v1/channels/webchat/**",
"/api/v1/talk/ws",
// RFC-045: tool-generated files served via unguessable UUID + 10-min TTL
// RFC-045: tool-generated files served via unguessable UUID; entries
// expire after GeneratedFileCache.TTL (7 days) — delayed access (e.g. an
// IM-delivered link opened later) is intentional, the UUID is the guard.
"/api/v1/files/generated/**"
).permitAll()
// 所有其他 API 接口需要认证