Protect local Tailscale sign-in credentials

internal/server/server.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"crypto/subtle"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -130,10 +131,17 @@ func (s *Server) Handler() http.Handler {
 	return http.NewCrossOriginProtection().Handler(mux)
 }
 
-func (s *Server) LoopbackHandler() http.Handler {
+func (s *Server) LoopbackHandler(token string) http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /api/tailnet", s.GetTailnet)
-	return mux
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if subtle.ConstantTimeCompare([]byte(r.Header.Get("Authorization")), []byte("Bearer "+token)) != 1 {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		mux.ServeHTTP(w, r)
+	})
 }
 
 func (s *Server) GetTailnet(w http.ResponseWriter, r *http.Request) {