Fix route authorization bypass vulnerability in HTTP handler

[leopardracer]

Summary

Replaced substring-based path matching with prefix-based matching in AuthTokenHandler to prevent authorization bypass attacks.

🔍 Problem

The original code used strings.Contains() for route authorization:

if (strings.Contains(r.URL.Path, api.WebApiUrlPrefix) || 
    strings.Contains(r.URL.Path, api.KeymanagerApiPrefix)) && 
   !strings.Contains(r.URL.Path, api.SystemLogsPrefix)

This approach is vulnerable to path traversal attacks where malicious URLs containing the protected prefixes as substrings could bypass authentication.

Solution

Changed to strings.HasPrefix() for precise prefix matching:

if (strings.HasPrefix(r.URL.Path, api.WebApiUrlPrefix) || 
    strings.HasPrefix(r.URL.Path, api.KeymanagerApiPrefix)) && 
   !strings.HasPrefix(r.URL.Path, "/"+api.SystemLogsPrefix)