Ways to hide /api/version and /api/v1/settings call from web ui when a user is unauthenticated?

[spookyintheam]

Hi,
We have setup ArgoCD with OIDC with Google on our GKE cluster. We found out that we can see the ArgoCD version by hitting https://argocd.company.com/api/version and The ClientID among a lot of other stuff (as can documented in the docs as well) used with Google OIDC by hitting https://argocd.company.com/api/v1/settings.

Since these calls are made when accessing the web UI and further confirmed by checking the network tab in browser console settings, I'm curious to know if there is a way to hide this information or stop these calls when the user is unauthenticated.

[rameshrithvik]

@spookyintheam what happened to this? I am sorry i couldnt see any reason for closing this and the previous issue/16445. Could you please provide a reason for this

[lohitkolluri]

Hey! So ArgoCD doesn't currently have a built-in toggle to disable these endpoints for unauthenticated users—there's been discussion about it in the community but nothing implemented yet.

The most practical workaround is to block those paths at the reverse proxy level before they reach ArgoCD. If you're using an Ingress controller (nginx-ingress, Traefik, or your GKE Ingress), you can add rules to reject requests to /api/version and /api/v1/settings when there's no auth header.

For example, with nginx-ingress something like this:

nginx.ingress.kubernetes.io/server-snippet: |
  location ~ ^/api/(version|v1/settings) {
    if ($http_authorization = "") {
      return 403;
    }
    proxy_pass http://argocd-server;
  }

This way the UI works fine for logged-in users, but unauthenticated requests to those paths get blocked entirely.

One thing to keep in mind though—the version number being public isn't usually considered high severity security-wise. And the OIDC client ID in the settings endpoint is typically public info anyway (it's literally in the URL your browser redirects to). Still, I get wanting to lock things down! The reverse proxy approach should do what you need.