From 77f215be84aa062ed4324a0b1a23571740ab3148 Mon Sep 17 00:00:00 2001 From: Markus Graf Date: Thu, 18 Jun 2026 17:20:01 +0200 Subject: [PATCH] refactor: explicitly handle missing API key header --- api/main.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/api/main.py b/api/main.py index 1890c37..eba821d 100644 --- a/api/main.py +++ b/api/main.py @@ -19,9 +19,11 @@ def get_api_key(api_key_header: str = Security(api_key_header)): # If no key is configured, deny all requests for safety raise HTTPException(status_code=500, detail="API_KEY not configured on server") - if hmac.compare_digest(api_key_header or "", expected_api_key): - return api_key_header - raise HTTPException(status_code=401, detail="Invalid or missing API Key") + if api_key_header is None: + raise HTTPException(status_code=401, detail="Missing API Key") + if not hmac.compare_digest(api_key_header, expected_api_key): + raise HTTPException(status_code=401, detail="Invalid API Key") + return api_key_header graphql_app = GraphQLRouter(schema)