mgr/dashboard_v2: Also protect `/api`

Signed-off-by: Sebastian Wagner <sebastian.wagner@suse.com>

diff --git a/src/pybind/mgr/dashboard_v2/module.py b/src/pybind/mgr/dashboard_v2/module.py
index f96692db6f4eb629c5e9ec449e2f2eeea1e35d96..ce228f33cb9beee10ea5e6c15a067a6c147ad3ab 100644 (file)
--- a/src/pybind/mgr/dashboard_v2/module.py
+++ b/src/pybind/mgr/dashboard_v2/module.py
@@ -158,6 +158,11 @@ class Module(MgrModule):
 
     class ApiRoot(object):
 
+        _cp_config = {
+            'tools.sessions.on': True,
+            'tools.authenticate.on': True
+        }
+
         def __init__(self, mgrmod):
             self.ctrls = load_controllers(mgrmod)
             logger.debug('Loaded controllers: %s', self.ctrls)

diff --git a/src/pybind/mgr/dashboard_v2/tests/test_auth.py b/src/pybind/mgr/dashboard_v2/tests/test_auth.py
index 63000ac206077e73758d222394a3e2809a645ebd..e0ad2265fed8743f80b29b32bd8fdeba425a9f05 100644 (file)
--- a/src/pybind/mgr/dashboard_v2/tests/test_auth.py
+++ b/src/pybind/mgr/dashboard_v2/tests/test_auth.py
@@ -72,3 +72,5 @@ class AuthTest(ControllerTestCase):
     def test_unauthorized(self):
         self._get("/api/host")
         self.assertStatus(401)
+        self._get("/api")
+        self.assertStatus(401)