feat: Adding routes handling, always going through ROUTES instead of hardcoded everywhere by DennisGaida · Pull Request #6886 · louislam/uptime-kuma

DennisGaida · 2026-02-07T13:16:19Z

Summary

I am fully aware this touches a lot of files, but in the end it all references back to routes.ts. Even if you don't like the URLs I am proposing (/admin/...), these could be easily changed in the routes.ts to the previous URLs/paths, but we would get away from those hardcoded paths.

In this pull request, the following changes are made:

Implemented routes.ts so all routes go through it for UX/UI and pretty URLs
Removes all hardcoded URLs / paths everywhere and I hope I haven't missed a spot
I tried testing all paths and all functionalities as well as setting up a completely new UK instance
All legacy URLs are being redirected automatically (see routes.js on the bottom) - no broken bookmarks/links
Documentation & Tests never reference paths directly hence nothing to update
I don't know how to do CI tests locally, so I didn't do that next to npm run dev, npm run tsc and node server/server.js, maybe there are some automatic GH actions?
Resolves Consistent routes / URIs for easier security hardening #2505

Please follow this checklist to avoid unnecessary back and forth (click to expand)

⚠️ If there are Breaking change (a fix or feature that alters existing functionality in a way that could cause issues) I have called them out
🧠 I have disclosed any use of LLMs/AI in this contribution and reviewed all generated content.
I understand that I am responsible for and able to explain every line of code I submit.
🔍 Any UI changes adhere to visual style of this project.
🛠️ I have self-reviewed and self-tested my code to ensure it works as expected.
📝 I have commented my code, especially in hard-to-understand areas (e.g., using JSDoc for methods).
🤖 I added or updated automated tests where appropriate.
📄 Documentation updates are included (if applicable).
🧰 Dependency updates are listed and explained.
⚠️ CI passes and is green.

CommanderStorm · 2026-02-07T19:25:34Z

Looks interesting.
It oes not currenty pass CI though, because of some TS-issue.

DennisGaida · 2026-02-07T20:42:56Z

PR title: ❌ can't fix, no permissions to prefix with feat:
e2e-tests: ✅ fixed, by using new paths hardcoded. Not sure whether I like this, but maybe tests need to have hardcoded paths
CI tests: ✅ only failed for node 20 through some weird quirk with import("routes") using the ts version instead of the js version. All a bit weird with the *.ts and *.js files lying in the same folder and manually having to adjust these files as stated in the util.js comment.
linters: ✅ fixed (would be fixed easily if tsconfig.json was just configured with "removeComments": false because tsc is actually throwing the comments away which the linters want again - I changed this setting now for tsconfig-backend so the linters don't complain when throwing JSDoc comments away)

louislam

As you understood, it is not a security hardening(#6886 (comment)).

I prefer not to disturb existing users by changing all URLs just to satisfy a small number of users. I personally don't like it unfortunately.

I prefer to keep the original URLs by default.

However, it will only be accepted if:

It is controlled via an environment variable, may be UPTIME_KUMA_FRONTEND_PREFIX?

Since there are many hardcoded URLs or crafted URLs in this repo, automated tests do not cover everything 100%, so you MUST manually review all files in the repository. For example, I saw someone craft the url like this:

uptime-kuma/server/notification-providers/teams.js

Lines 217 to 219 in 0a578fa

    
           if (baseURL) { 
        
               dashboardUrl = baseURL + getMonitorRelativeURL(monitorJSON.id); 
        
           }

For the same reason, you must manually test every feature.

DennisGaida · 2026-02-08T08:21:34Z

1. It is controlled via an environment variable, may be `UPTIME_KUMA_FRONTEND_PREFIX`?

I like that, good idea. Will have a think about this and add - ultimately I want the frontend itself to be at the root level and all "setting" / "admin" stuff to be in a subpath, but making this configurable for the user sounds perfect.

3. For the same reason, you must manually test every feature.

Of course I did that as good as I can. Clicking every button etc., but one can never be sure of course. But thanks for that example I'll go through stuff some more.

For the PR, I will then just change the URLs to be the current state - in the end we would have cleaner URL management and not hardcoded URLs scattered everywhere and by environment variables you will be able to set "your own" path for admin stuff.

…ded everywhere

…with no extension

…ts with no extension

…ork. - ran npm rnu test-backend-20

…nters works

- routes built dynamically with buildRoutes() - e2e tests now use ROUTES instead of hardcoded paths

To not overcomplicate things, let's not have the possibility for cli injection of this parameter. Otherweise we would need to rewrite e.g. config.js

DennisGaida · 2026-02-09T11:15:17Z

Alright. Made this less invasive by keeping the default (i.e. no prefix).

Added UPTIME_KUMA_ADMIN_PREFIX, also documented in this PR for the wiki: feat: Adding documentation for PR #6886 uptime-kuma-wiki#141
You can now add a prefix to the admin routes by just setting UPTIME_KUMA_ADMIN_PREFIX to e.g. "/admin" and all your routes look pretty
Checked every method and every file and replaced hardcoded paths with the respectice methods (mostly it is getMonitorURL()) ~~[edit: will fix that e2e test. more hidden hardcodes]~~
This also fixes a small functional bug in socket.js where the regex was too broad - maybe this is even a different PR?
Updated the router.js logic to catch all "old" URLs if they were used with or without prefix

Whereas I do agree with you @louislam, that this is purely a UX feature and has no real security benefit, it would still feel better to to "block" all URLs beginning with "/admin" from public - but this is besides the point of this PR. This PR now only gives the possibility to users to set a prefix or don't (default).

The biggest benefit of this PR though is that all the hardcoded paths are removed from the codebase.

the regex was too broad matching administrative routes such as /status-page/add in addition to public routes such as /status/:slug.

DennisGaida mentioned this pull request Feb 7, 2026

Consistent routes / URIs for easier security hardening #2505

Closed

1 task

DennisGaida marked this pull request as draft February 7, 2026 16:29

DennisGaida marked this pull request as ready for review February 7, 2026 16:29

DennisGaida marked this pull request as draft February 7, 2026 16:29

github-actions bot added the pr:needs review this PR needs a review by maintainers or other community members label Feb 7, 2026

CommanderStorm changed the title ~~Adding routes handling, always going through ROUTES instead of hardcoded everywhere~~ feat: Adding routes handling, always going through ROUTES instead of hardcoded everywhere Feb 8, 2026

louislam requested changes Feb 8, 2026

View reviewed changes

DennisGaida and others added 11 commits February 9, 2026 08:56

Adding routes handling, always going through ROUTES instead of hardco…

bd391ea

…ded everywhere

[autofix.ci] apply automated fixes

dddf604

fix linting warnings about JSDoc

c1850c8

fix e2e-tests with hardcoded URLs

1a88bc1

import the js directly to fix node 20 compatibility which may use ts …

08e4675

…with no extension

[autofix.ci] apply automated fixes

fd1dee9

more direct js references to fix node 20 compatibility which may use …

7992b40

…ts with no extension

using no extension, may be it for util.js. tested locally, this may w…

80ad467

…ork. - ran npm rnu test-backend-20

[autofix.ci] apply automated fixes

23d7e9f

more linter fixes, let's not remove comments for backend, so check-li…

6d5318f

…nters works

[autofix.ci] apply automated fixes

a54283f

DennisGaida force-pushed the feature/route-reorganization branch from cbdd2ba to a54283f Compare February 9, 2026 07:58

DennisGaida and others added 7 commits February 9, 2026 11:27

make admin route prefix configurable via env/cli arg

3526de3

- routes built dynamically with buildRoutes() - e2e tests now use ROUTES instead of hardcoded paths

[autofix.ci] apply automated fixes

07afb9d

remove cli-possibility to not have a race-condition

f90ba7a

To not overcomplicate things, let's not have the possibility for cli injection of this parameter. Otherweise we would need to rewrite e.g. config.js

autofix removing returns, thanks autofix

f45c51b

[autofix.ci] apply automated fixes

ecbd261

more autofix fixes

173366e

[autofix.ci] apply automated fixes

ffaf567

DennisGaida mentioned this pull request Feb 9, 2026

feat: Adding documentation for PR #6886 louislam/uptime-kuma-wiki#141

Draft

replaced some more hardcoded paths

fd221c2

DennisGaida added 3 commits February 9, 2026 12:19

expose getMonitorURL to template

f379216

e2e tests caught a couple of more hardcoded URLs

c4d5fff

socket not connecting on /status-page/* administrative routes

52f120b

the regex was too broad matching administrative routes such as /status-page/add in addition to public routes such as /status/:slug.

github-actions bot added the needs:resolve-merge-conflict label Feb 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Adding routes handling, always going through ROUTES instead of hardcoded everywhere#6886

feat: Adding routes handling, always going through ROUTES instead of hardcoded everywhere#6886
DennisGaida wants to merge 22 commits intolouislam:masterfrom
DennisGaida:feature/route-reorganization

DennisGaida commented Feb 7, 2026

Uh oh!

CommanderStorm commented Feb 7, 2026

Uh oh!

DennisGaida commented Feb 7, 2026 •

edited

Loading

Uh oh!

louislam left a comment •

edited

Loading

Uh oh!

DennisGaida commented Feb 8, 2026

Uh oh!

DennisGaida commented Feb 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	if (baseURL) {
	dashboardUrl = baseURL + getMonitorRelativeURL(monitorJSON.id);
	}

Uh oh!

Conversation

DennisGaida commented Feb 7, 2026

Summary

Uh oh!

CommanderStorm commented Feb 7, 2026

Uh oh!

DennisGaida commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

louislam left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DennisGaida commented Feb 8, 2026

Uh oh!

DennisGaida commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

DennisGaida commented Feb 7, 2026 •

edited

Loading

louislam left a comment •

edited

Loading

DennisGaida commented Feb 9, 2026 •

edited

Loading