Add setup token security for initial server setup #1121

New Issue

MrUnknownDE · 2026-04-05T18:19:24+02:00

MrUnknownDE commented

2026-04-05 18:19:24 +02:00

Originally created by @adrianeastles on 8/3/2025

🛡️ Security Enhancement: Setup Token for Initial Server Setup

Problem

When spinning up a new Pangolin server, anyone in the world could potentially access the initial setup page and create the first admin account before the legitimate administrator, posing a security risk.

Solution

Implemented a setup token system that requires a secure token to be entered during the initial server setup process. The token is generated and displayed in the server console on startup until the token is used.

Initial Setup Page

Navigate to http://localhost:3002/auth/initial-setup.
You should see a new "Setup Token" field at the top.
Enter the token from the server console.
Fill in the email and password fields.
Submit the form.
Expected Behavior:
- ✅ The form accepts a valid token and creates the admin.
- ❌ The form rejects an invalid token with an error message.

Screenshots

*Originally created by @adrianeastles on 8/3/2025* ### 🛡️ Security Enhancement: Setup Token for Initial Server Setup ### Problem When spinning up a new Pangolin server, anyone in the world could potentially access the initial setup page and create the first admin account before the legitimate administrator, posing a security risk. ### Solution Implemented a setup token system that requires a secure token to be entered during the initial server setup process. The token is generated and displayed in the server console on startup until the token is used. ### **Initial Setup Page** 1. Navigate to `http://localhost:3002/auth/initial-setup`. 2. You should see a new "Setup Token" field at the top. 3. Enter the token from the server console. 4. Fill in the email and password fields. 5. Submit the form. 6. **Expected Behavior:** * ✅ The form accepts a valid token and creates the admin. * ❌ The form rejects an invalid token with an error message. ### Screenshots <img width="828" height="162" alt="Screenshot 2025-08-03 at 9 25 33 pm" src="https://github.com/user-attachments/assets/7b2b3835-cc79-445b-b061-a93ba92e4ea0" /> <img width="460" height="657" alt="Screenshot 2025-08-03 at 9 27 23 pm" src="https://github.com/user-attachments/assets/30254493-1ca2-4d67-95ee-3df931423417" /> <img width="469" height="736" alt="Screenshot 2025-08-03 at 9 27 46 pm" src="https://github.com/user-attachments/assets/193d6fae-0362-4296-9630-f1e428a710fe" /> <img width="818" height="123" alt="Screenshot 2025-08-03 at 9 28 15 pm" src="https://github.com/user-attachments/assets/414db17f-223b-463c-ae4d-535f61827218" />

MrUnknownDE closed this issue

2026-04-05 18:19:24 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1121