ability to have webUI and API on different ports about server HOT 4 CLOSED

You can almost be 100% sure if you only try the /message api because the error description is probably unique and no other app uses it exactly like that. If you still want to do this block the UI paths via your reverse proxy from external access or compile gotify yourself without the ui part.

This isn't something that will be natively supported because you don't really gain anything.

from server.

You don't get any additional security by limit access to the web ui. A potential attacker can do everything that's available in the WebUI and more through the API.

from server.

currently people reaching gotify's port (e.g., through a reverse proxy mapping sub1.example.com to gotify) are able to tell what service is running. if you go straight to the API (e.g., sub1.example.com/message) you get a 401 in most cases and the health and version infos are a bit less helpful.

on a parallel note, does the app log http errors anywhere?

from server.

ok, thanks. I'll close it as not planned. :)

from server.