{"record":{"id":"5a3e9871efa0a48b","repo":"NARKOZ/hacker-scripts","slug":"unauthorized","errorCode":null,"errorMessage":"Unauthorized","messagePattern":"Unauthorized","errorType":"http","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"nodejs/fucking_coffee_yo_server.js","lineNumber":35,"sourceCode":"var CALLBACK_ENDPOINT = '/coffeemachine';\n\nvar PORT = '3000';\n\nexec(\"who -q\", function(error, stdout, stderr) {\n\n    var express = require('express');\n    var coffeeApp = express();\n\n    // Exit if no sessions with my username are found\n    if(stdout.indexOf(ME) == -1)\n        process.exit(1);\n\n    // Got a Yo!\n    coffeeApp.get(CALLBACK_ENDPOINT, function (req, res) {\n\n        if(req.query.username === undefined) {\n            // Not a Yo, don't make coffee.\n            res.sendStatus(401);\n        }\n        else if(AUTHORIZED_YO_NAMES.indexOf(req.query.username) == -1) {\n            // If authorized users didn't Yo, don't make coffee.\n            res.sendStatus(401);\n\n            console.log(req.query.username + ' YO\\'d.')\n        }\n        else {\n            res.sendStatus(200);\n\n            var coffee_machine_ip = 'xxx.xxx.xxx.xxx';\n            var password = 'xxxx';\n            var con = new telnet();\n\n            con.on('ready', function(prompt) {\n                con.exec('Password: ' + password, function(error, res) {\n\n                    // Brew Coffee!","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/NARKOZ/hacker-scripts/blob/b14a0a89bdf743c63ca4cc9cbcd866e050d7b3b0/nodejs/fucking_coffee_yo_server.js#L17-L53","documentation":"Express route handler for the Yo callback endpoint calls res.sendStatus(401) (HTTP Unauthorized) when the incoming GET request has no username query parameter. The server treats any request lacking ?username= as 'not a Yo' and refuses to brew coffee. This is hand-written application authorization logic inside the route, not Express auth middleware or a library-thrown exception.","triggerScenarios":"A GET request to CALLBACK_ENDPOINT with no query string (e.g. curl http://host:port/<CALLBACK_ENDPOINT> or a browser hit to the raw endpoint). Also triggered by a malformed Yo provider callback that omits the username field, or by an uptime/health monitor that pings the callback URL without parameters.","commonSituations":"Operator browses to the callback URL to confirm the server is alive and receives 401. The Yo account callback URL is misconfigured so the provider never appends the username. A reverse proxy, load balancer, or cron health-checker probes the endpoint with a bare GET. Port scanners hitting the callback path.","solutions":["Append ?username=<an-authorized-name> to the URL when testing manually (e.g. curl 'http://host:port/<CALLBACK_ENDPOINT>?username=alice').","Verify the Yo provider callback is configured to the full CALLBACK_ENDPOINT so it includes the username field on each Yo.","Add a separate lightweight health route (GET /health -> 200) so monitoring never hits the auth-gated callback.","Log req.url inside the 401 branch to confirm whether the query string is missing entirely or merely malformed."],"exampleFix":"// before\ncoffeeApp.get(CALLBACK_ENDPOINT, function (req, res) {\n    if(req.query.username === undefined) {\n        res.sendStatus(401);\n    }\n    ...\n\n// after - dedicated health route + clearer rejection\ncoffeeApp.get('/health', function (req, res) { res.sendStatus(200); });\ncoffeeApp.get(CALLBACK_ENDPOINT, function (req, res) {\n    if (!req.query.username) {\n        console.log('Rejected: no username in', req.url);\n        return res.sendStatus(401);\n    }\n    ...","handlingStrategy":"validation","validationCode":"// Client-side: build the callback URL with a username before sending\nfunction buildYoCallbackUrl(base, endpoint, username) {\n  if (!username) {\n    throw new Error('username query param is required by the callback');\n  }\n  return base + endpoint + '?username=' + encodeURIComponent(username);\n}\n// fetch(buildYoCallbackUrl(HOST, CALLBACK_ENDPOINT, 'alice'))","typeGuard":"// Server-side narrowing guard (replaces the bare undefined check)\nfunction hasUsername(req) {\n  return typeof req.query.username === 'string' && req.query.username.length > 0;\n}\n// if (!hasUsername(req)) return res.sendStatus(401);","tryCatchPattern":null,"preventionTips":["Never probe the callback endpoint with a bare GET; always include ?username=.","Give monitors a dedicated /health route so they cannot trip the auth gate.","Log req.url on every 401 so a missing query string is obvious in the logs."],"tags":["express","http-401","authentication","query-params","nodejs"],"backgroundTag":null,"analyzedSha":"b14a0a89bdf743c63ca4cc9cbcd866e050d7b3b0","analyzedAt":"2026-08-13T01:34:52.027Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}