3 people cbcd5adcc0 fix(security): restrict query-token auth to SSE endpoints only (#528) ...

* fix(security): restrict query-token auth to SSE endpoints only

Query-string `?token=xxx` auth was accepted on all endpoints, exposing
the main auth token in server logs, Referer headers, and browser history
for state-changing routes. Now only GET /api/chat/events and
GET /api/logs/events accept query tokens; all other endpoints require
the Authorization header.

Supersedes #364.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: add WebSocket endpoint to query-token allowlist, add URL-encoding tests

The WS upgrade at /api/chat/ws also can't set custom headers, so it
needs query-token auth like the SSE endpoints. Also adds tests for
URL-encoded token values to cover the form_urlencoded parser.

Addresses review feedback from Gemini (partially, /api/jobs/{id}/events
is a JSON endpoint not SSE, so it correctly stays excluded) and Copilot
(URL-encoded token test).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

2026-03-04 20:06:51 +00:00

..

handlers

fix(web): assign unique thread_id to manual routine triggers (#500)

2026-03-04 00:41:41 +00:00

static

fix(web): reset job list UI on restart failure (#499)

2026-03-04 10:05:42 -08:00

auth.rs

fix(security): restrict query-token auth to SSE endpoints only (#528)

2026-03-04 20:06:51 +00:00

log_layer.rs

feat(web): display logs newest-first in web gateway UI (#369)

2026-02-25 16:00:09 -08:00

mod.rs

feat(web): fix jobs UI parity for non-sandbox mode (#491)

2026-03-03 22:23:30 +08:00

openai_compat.rs

feat: support per-request model override in /v1/chat/completions (#103)

2026-02-19 21:45:37 +00:00

server.rs

feat: add OAuth support for WASM tools in web gateway (#489)

2026-03-04 01:08:40 +08:00

sse.rs

feat(web): fix jobs UI parity for non-sandbox mode (#491)

2026-03-03 22:23:30 +08:00

types.rs

fix(skills): use slug for skill download URL from ClawHub (#502)

2026-03-03 23:53:16 +00:00

util.rs

feat(web): persist tool calls, restore approvals on thread switch, and UI fixes (#382)

2026-02-27 17:46:37 +04:00

ws.rs

feat(web): fix jobs UI parity for non-sandbox mode (#491)

2026-03-03 22:23:30 +08:00