Allow /api/ routes without WebAuthentication (#2455)

runatlantis · Sep 8, 2022 · 99e1f10 · 99e1f10
1 parent b3b1107
commit 99e1f10
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/server/middleware.go b/server/middleware.go
@@ -15,6 +15,7 @@ package server
 
 import (
 	"net/http"
+	"strings"
 
 	"github.com/runatlantis/atlantis/server/logging"
 	"github.com/urfave/negroni"
@@ -46,7 +47,8 @@ func (l *RequestLogger) ServeHTTP(rw http.ResponseWriter, r *http.Request, next
 	if !l.WebAuthentication ||
 		r.URL.Path == "/events" ||
 		r.URL.Path == "/healthz" ||
-		r.URL.Path == "/status" {
+		r.URL.Path == "/status" ||
+		strings.HasPrefix(r.URL.Path, "/api/") {
 		allowed = true
 	} else {
 		user, pass, ok := r.BasicAuth()