NARKOZ/hacker-scripts · warning

Unauthorized

Error message

Unauthorized

What it means

Express route handler for the Yo callback endpoint calls res.sendStatus(401) (HTTP Unauthorized) when the incoming GET request has no username query parameter. The server treats any request lacking ?username= as 'not a Yo' and refuses to brew coffee. This is hand-written application authorization logic inside the route, not Express auth middleware or a library-thrown exception.

Source

Thrown at nodejs/fucking_coffee_yo_server.js:35

var CALLBACK_ENDPOINT = '/coffeemachine';

var PORT = '3000';

exec("who -q", function(error, stdout, stderr) {

    var express = require('express');
    var coffeeApp = express();

    // Exit if no sessions with my username are found
    if(stdout.indexOf(ME) == -1)
        process.exit(1);

    // Got a Yo!
    coffeeApp.get(CALLBACK_ENDPOINT, function (req, res) {

        if(req.query.username === undefined) {
            // Not a Yo, don't make coffee.
            res.sendStatus(401);
        }
        else if(AUTHORIZED_YO_NAMES.indexOf(req.query.username) == -1) {
            // If authorized users didn't Yo, don't make coffee.
            res.sendStatus(401);

            console.log(req.query.username + ' YO\'d.')
        }
        else {
            res.sendStatus(200);

            var coffee_machine_ip = 'xxx.xxx.xxx.xxx';
            var password = 'xxxx';
            var con = new telnet();

            con.on('ready', function(prompt) {
                con.exec('Password: ' + password, function(error, res) {

                    // Brew Coffee!

View on GitHub (pinned to b14a0a89bd)

Solutions

1. Append ?username=<an-authorized-name> to the URL when testing manually (e.g. curl 'http://host:port/<CALLBACK_ENDPOINT>?username=alice').
2. Verify the Yo provider callback is configured to the full CALLBACK_ENDPOINT so it includes the username field on each Yo.
3. Add a separate lightweight health route (GET /health -> 200) so monitoring never hits the auth-gated callback.
4. Log req.url inside the 401 branch to confirm whether the query string is missing entirely or merely malformed.

Example fix

// before
coffeeApp.get(CALLBACK_ENDPOINT, function (req, res) {
    if(req.query.username === undefined) {
        res.sendStatus(401);
    }
    ...

// after - dedicated health route + clearer rejection
coffeeApp.get('/health', function (req, res) { res.sendStatus(200); });
coffeeApp.get(CALLBACK_ENDPOINT, function (req, res) {
    if (!req.query.username) {
        console.log('Rejected: no username in', req.url);
        return res.sendStatus(401);
    }
    ...

// Client-side: build the callback URL with a username before sending
function buildYoCallbackUrl(base, endpoint, username) {
  if (!username) {
    throw new Error('username query param is required by the callback');
  }
  return base + endpoint + '?username=' + encodeURIComponent(username);
}
// fetch(buildYoCallbackUrl(HOST, CALLBACK_ENDPOINT, 'alice'))

// Server-side narrowing guard (replaces the bare undefined check)
function hasUsername(req) {
  return typeof req.query.username === 'string' && req.query.username.length > 0;
}
// if (!hasUsername(req)) return res.sendStatus(401);

When it happens

Trigger: A GET request to CALLBACK_ENDPOINT with no query string (e.g. curl http://host:port/<CALLBACK_ENDPOINT> or a browser hit to the raw endpoint). Also triggered by a malformed Yo provider callback that omits the username field, or by an uptime/health monitor that pings the callback URL without parameters.

Common situations: Operator browses to the callback URL to confirm the server is alive and receives 401. The Yo account callback URL is misconfigured so the provider never appends the username. A reverse proxy, load balancer, or cron health-checker probes the endpoint with a bare GET. Port scanners hitting the callback path.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Not Found

AI-assisted analysis of NARKOZ/hacker-scripts@b14a0a89bd (2026-08-13). Data as JSON: /api/errors/5a3e9871efa0a48b. Report an issue: GitHub.