mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove unused token query param fallback from WS auth

Browse Source 
The ?token= fallback leaked JWTs in server logs and was never used by
the client, which always sends the token via WebSocket subprotocol
header.
This commit is contained in:
Mike Teehan
2026-07-31 00:00:28 +00:00
parent c64f988ba2
commit ba0c7bfa9b
1 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
daemon/server.py
-4
View File
@@ -372,7 +372,6 @@ async def _handle_ws(request: web.Request) -> web.Response:
Authentication: JWT access token passed via: Authentication: JWT access token passed via:
1. WebSocket subprotocol header (Sec-WebSocket-Protocol: "Bearer <token>") 1. WebSocket subprotocol header (Sec-WebSocket-Protocol: "Bearer <token>")
2. X-Auth-Token header (nginx-injected) 2. X-Auth-Token header (nginx-injected)
3. token query parameter (dev fallback)
""" """
from lib.auth import validate_token from lib.auth import validate_token
@@ -388,9 +387,6 @@ async def _handle_ws(request: web.Request) -> web.Response:
if token_param is None: if token_param is None:
token_param = request.headers.get("X-Auth-Token") token_param = request.headers.get("X-Auth-Token")
if token_param is None:
token_param = request.query.get("token")
if token_param is None: if token_param is None:
return web.json_response( return web.json_response(
{"ok": False, "error": "authentication required"}, status=401 {"ok": False, "error": "authentication required"}, status=401