[Enhancement]: The Dashboard Has No Authentication — Add a Simple API Key or Basic Auth Gate to the Gateway

[divyanshim27]

Summary

Arachnode's dashboard at http://localhost:8080 is fully open with no authentication layer. While this is a self-hosted personal tool, the gateway exposes powerful endpoints — including the ability to trigger scrapers (POST /api/scrape), send emails (POST /api/workflow/apply), and read all discovered contacts and email drafts. Without any access control, anyone with network access to the host can trigger scraping jobs, read personal contact data, or send emails on the operator's behalf.

Problem

• All gateway endpoints (/api/jobs, /api/scrape, /api/contacts, /api/generate, /api/workflow/apply) have no authentication requirement.
• If Arachnode is deployed on a VPS, home server, or shared network, any user on that network (or the internet if the port is exposed) can access the dashboard and all its capabilities.
• POST /api/workflow/apply can trigger email sending via Gmail SMTP — this is a critical action that must be gated.
• There is no rate limiting on the gateway endpoints beyond what individual services implement.
• The README's self-hosted deployment instructions do not mention any security considerations for exposing the gateway port.

Impact

• In any networked deployment scenario, the gateway is fully open to unauthorized use.
• Email sending capabilities could be abused to send unauthorized outreach if the gateway is accessible externally.
• Contact and job data collected via OSINT (which is personal and private to the operator) is exposed to any network client.

Proposed Solution

I will implement a simple API key authentication middleware on the gateway:

1. API key configuration via environment variable:

# In gateway/.env
GATEWAY_API_KEY=your-long-random-secret-key-here

2. FastAPI authentication dependency:

from fastapi import Header, HTTPException, Security
from fastapi.security.api_key import APIKeyHeader
import os

API_KEY = os.getenv("GATEWAY_API_KEY")
api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)

async def verify_api_key(api_key: str = Security(api_key_header)):
    if API_KEY and api_key != API_KEY:
        raise HTTPException(status_code=403, detail="Invalid or missing API key")
    return api_key

3. Apply to all gateway routes:

@app.get("/api/jobs", dependencies=[Depends(verify_api_key)])
async def get_jobs(...):
    ...

4. Update dashboard.html to read the API key from a one-time setup prompt and store it in sessionStorage, attaching it to all fetch() calls as an X-API-Key header.

5. Add GATEWAY_API_KEY to .env.example with a note that it is optional (disabled if empty) for local use but strongly recommended for any networked deployment.

Additional Notes

• When GATEWAY_API_KEY is not set, the middleware will allow all requests (preserving backward compatibility for local development).
• I will update the README with a "Security" section advising operators to set an API key before exposing the port externally.
• The dashboard JS will handle 403 responses with a re-authentication prompt.

I would like to implement this. Please assign the issue to me.

Labels: security, enhancement, backend, help wanted, GSSoC 2026

[divyanshim27]

Hey @sharmavaibhav31 ,
Please assign it to me under GSSoC 2026.
/assign /claim /claim-assignment