* auth: respond with 403 for API requests when not authenticated

home/auth.go

@@ -406,8 +406,13 @@ func optionalAuth(handler func(http.ResponseWriter, *http.Request)) func(http.Re
 				}
 			}
 			if !ok {
-				w.Header().Set("Location", "/login.html")
-				w.WriteHeader(http.StatusFound)
+				if r.URL.Path == "/" || r.URL.Path == "/index.html" {
+					w.Header().Set("Location", "/login.html")
+					w.WriteHeader(http.StatusFound)
+				} else {
+					w.WriteHeader(http.StatusForbidden)
+					_, _ = w.Write([]byte("Forbidden"))
+				}
 				return
 			}
 		}

home/home_test.go

@@ -114,6 +114,7 @@ func TestHome(t *testing.T) {
 	assert.True(t, ioutil.WriteFile(fn, []byte(yamlConf), 0644) == nil)
 	fn, _ = filepath.Abs(fn)
 
+	config = configuration{} // the global variable is dirty because of the previous tests run
 	args := options{}
 	args.configFilename = fn
 	args.workDir = dir