From 99e1f10c2ed889a89c9471d87da618dc2ed7b1fc Mon Sep 17 00:00:00 2001
From: Vincent <106497818+vincentgna@users.noreply.github.com>
Date: Thu, 8 Sep 2022 07:46:18 +0700
Subject: [PATCH] Allow /api/ routes without WebAuthentication (#2455)

---
 server/middleware.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/server/middleware.go b/server/middleware.go
index 089394f77..9ce9d7a9f 100644
--- a/server/middleware.go
+++ b/server/middleware.go
@@ -15,6 +15,7 @@ package server
 
 import (
 	"net/http"
+	"strings"
 
 	"github.com/runatlantis/atlantis/server/logging"
 	"github.com/urfave/negroni"
@@ -46,7 +47,8 @@ func (l *RequestLogger) ServeHTTP(rw http.ResponseWriter, r *http.Request, next
 	if !l.WebAuthentication ||
 		r.URL.Path == "/events" ||
 		r.URL.Path == "/healthz" ||
-		r.URL.Path == "/status" {
+		r.URL.Path == "/status" ||
+		strings.HasPrefix(r.URL.Path, "/api/") {
 		allowed = true
 	} else {
 		user, pass, ok := r.BasicAuth()