web

Private API of web, the main Overleaf app. Other services (real-time, document-updater, project-history, third-party-datastore, git-bridge) and the cron scripts of the Server CE image call it. These routes need HTTP basic auth only, no CSRF token: the private router is mounted before the web router, and only the web router runs the CSRF check. With BLOCK_CROSS_ORIGIN_REQUESTS=true (off by default) web returns 403 for any request whose Origin header is not in ALLOWED_ORIGINS (default: the site URL). Browsers send Origin on POST, so with that switch on, POSTs sent from Hoppscotch in the browser get 403 unless they go through the Hoppscotch proxy.

• Address: http://web:3000, inside the Docker network
• Authentication: HTTP basic auth with WEB_API_USER and WEB_API_PASSWORD, except for status, health and metrics. The git-bridge routes take a personal access token instead.
• OpenAPI file: develop/hoppscotch/openapi/web.yaml