Secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141) #150

Merged
fen merged 1 commits from fix-137-141-drop-query-secrets into dev 2026-09-10 04:23:27 +00:00
Collaborator

Fixes #137, fixes #141

Query strings land in Traefik access logs, browser history, and Referer headers, so accepting the admin key (?key=) or paste passwords (?password=) there leaked the secrets to anyone with log access.

  • adminKeyOK now accepts the key only via X-Admin-Key
  • GET paste/can/items accept the password only via X-Paste-Password (POST unlock form unchanged)
  • Tests updated; new negative cases assert 401 for the query paths
  • go vet + go test green; behavior verified live: query 401, header 200
Fixes #137, fixes #141 Query strings land in Traefik access logs, browser history, and Referer headers, so accepting the admin key (?key=) or paste passwords (?password=) there leaked the secrets to anyone with log access. - adminKeyOK now accepts the key only via X-Admin-Key - GET paste/can/items accept the password only via X-Paste-Password (POST unlock form unchanged) - Tests updated; new negative cases assert 401 for the query paths - go vet + go test green; behavior verified live: query 401, header 200
fen added 1 commit 2026-09-10 04:23:12 +00:00
Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141)
CI / docker (pull_request) Skipped
CI / test (pull_request) Successful in 28s
d013f3965f
Query strings leak into Traefik access logs, browser history, and Referer
headers. Admin key is now accepted only via X-Admin-Key; paste and can
passwords only via X-Paste-Password (or the POST unlock form). Tests
updated; new negative cases assert 401 for the query paths.
fen merged commit d44e4d1587 into dev 2026-09-10 04:23:27 +00:00
Sign in to join this conversation.