/admin/queues and the OpenAPI surface at /docs. Both answer 404 to anyone who is not a signed in owner.
Why 404 and not 403?
A403 confirms that the thing you asked for exists. A 404 does not.
Anonymous callers therefore get the same answer whether the surface is present, disabled or was never built. There is no login prompt to attack, and a scanner learns nothing from the response.
If you expected a sign in page on /admin/queues and got a not found page, nothing is broken. Sign in as the owner in the same browser and reload.
The queue dashboard
/admin/queues serves Bull Board, which shows every queue, its waiting, active, completed and failed jobs, and lets an owner retry a failed job.
The owner gate is unconditional. There is no configuration that opens the queue dashboard to anonymous callers.
The OpenAPI surface
API_DOCS controls who may read /docs, /docs-json and /docs-yaml.
public is a deliberate choice, not an accident, and it is reasonable when the API surface is meant to be read by people you have not given accounts to.
Both are reached through the web origin
You never reach either surface on the API port. The web app serves route handlers at the identical paths and proxies them through. Identical paths matter: both surfaces are single page applications that build their asset URLs from the path they are mounted on, so serving/admin/queues at any other path breaks its own assets.
The gate itself runs before the application framework’s guards, because both surfaces register their own routing outside them. It resolves the session cookie or the asob_ token itself, and the queue dashboard re asserts the grant afterwards, so a deployment that forgot the wiring fails closed rather than open.
Retired variables
BULL_BOARD_USER and BULL_BOARD_PASSWORD are ignored. The dashboard used to use basic authentication and now requires an owner session or a personal API token instead.
The API logs a warning at boot if either is still set. Remove them from your environment.
Related
Personal API tokens
An owner token reaches both surfaces.
Health checks and monitoring
Queue health without opening the dashboard.