summaryrefslogtreecommitdiffhomepage
path: root/client/web/src/api.ts
AgeCommit message (Collapse)AuthorFilesLines
2025-05-22client/web: add Sec-Fetch-Site CSRF protection (#16046)Patrick O'Doherty1-10/+0
RELNOTE=Fix CSRF errors in the client Web UI Replace gorilla/csrf with a Sec-Fetch-Site based CSRF protection middleware that falls back to comparing the Host & Origin headers if no SFS value is passed by the client. Add an -origin override to the web CLI that allows callers to specify the origin at which the web UI will be available if it is hosted behind a reverse proxy or within another application via CGI. Updates #14872 Updates #15065 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2023-12-11client/web: add visual indication for exit node pending approval (#10532)Mario Minardi1-2/+8
Add visual indication when running as an exit node prior to receiving admin approval. Updates https://github.com/tailscale/tailscale/issues/10261 Signed-off-by: Mario Minardi <mario@tailscale.com> Co-authored-by: Sonia Appasamy <sonia@tailscale.com>
2023-12-11client/web: add endpoint for logging device detail click metric (#10505)Mario Minardi1-1/+0
Add an endpoint for logging the device detail click metric to allow for this metric to be logged without having a valid session which is the case when in readonly mode. Updates https://github.com/tailscale/tailscale/issues/10261 Signed-off-by: Mario Minardi <mario@tailscale.com>
2023-12-07client/web: restructure api mutations into hookSonia Appasamy1-10/+253
This commit makes some restructural changes to how we handle api posting from the web client frontend. Now that we're using SWR, we have less of a need for hooks like useNodeData that return a useSWR response alongside some mutation callbacks. SWR makes it easy to mutate throughout the UI without needing access to the original data state in order to reflect updates. So, we can fetch data without having to tie it to post callbacks that have to be passed around through components. In an effort to consolidate our posting endpoints, and make it easier to add more api handlers cleanly in the future, this change introduces a new `useAPI` hook that returns a single `api` callback that can make any changes from any component in the UI. The hook itself handles using SWR to mutate the relevant data keys, which get globally reflected throughout the UI. As a concurrent cleanup, node types are also moved to their own types.ts file, to consolidate data types across the app. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-12-07client/web: add additional web client metrics logging (#10462)Mario Minardi1-0/+8
Add additional web client metric logging. Namely, add logging events for auth / deauth, enable / disable using exit node, enable / disable SSH, enable / disable advertise routes, and click events on the device details button. Updates https://github.com/tailscale/tailscale/issues/10261 Signed-off-by: Mario Minardi <mario@tailscale.com>
2023-12-06client/web: start using swr for some fetchingSonia Appasamy1-14/+26
Adds swr to the web client, and starts by using it from the useNodeData hook. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-12-06.github/workflows: add webclient workflowSonia Appasamy1-9/+12
Add workflow to run yarn lint/test/format-check against the web client on pull requests. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-12-05client/web: add metric logging logic to the web client (#10434)Mario Minardi1-0/+27
Add metric logging logic for the web client frontend. This is an initial pass of adding the base logic, plus a single point where it is used for validation that the logging is working correctly. More metric logging calls will follow in subsquent PRs. Updates https://github.com/tailscale/tailscale/issues/10261 Signed-off-by: Mario Minardi <mario@tailscale.com>
2023-11-28scripts/check_license_headers: enforce license on ts/tsx filesSonia Appasamy1-0/+3
Enforcing inclusion of our OSS license at the top of .ts and .tsx files. Also updates any relevant files in the repo that were previously missing the license comment. An additional `@license` comment is added to client/web/src/index.tsx to preserve the license in generated Javascript. Updates #10261 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-11-13client/web: add Tailscale SSH viewSonia Appasamy1-1/+1
Updates tailscale/corp#14335 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-11-01web/client: update synology token from /api/auth callWill Norris1-3/+12
When the /api/auth response indicates that synology auth is needed, fetch the SynoToken and store it for future API calls. This doesn't yet update the server-side code to set the new SynoAuth field. Updates tailscale/corp#14335 Signed-off-by: Will Norris <will@tailscale.com>
2023-09-01client/web,cmd/tailscale: add prefix flag for web commandWill Norris1-1/+1
We already had a path on the web client server struct, but hadn't plumbed it through to the CLI. Add that now and use it for Synology and QNAP instead of hard-coding the path. (Adding flag for QNAP is tailscale/tailscale-qpkg#112) This will allow supporting other environments (like unraid) without additional changes to the client/web package. Also fix a small bug in unraid handling to only include the csrf token on POST requests. Updates tailscale/corp#13775 Signed-off-by: Will Norris <will@tailscale.com>
2023-08-29client/web: pipe unraid csrf token through apiFetchSonia Appasamy1-9/+30
Ensures that we're sending back the csrf token for all requests made back to unraid clients. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
2023-08-29client/web: pull SynoToken logic into apiFetchSonia Appasamy1-5/+19
Updates tailscale/corp#13775
2023-08-21client/web: add csrf protection to web client apiSonia Appasamy1-0/+32
Adds csrf protection and hooks up an initial POST request from the React web client. Updates tailscale/corp#13775 Signed-off-by: Sonia Appasamy <sonia@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.