Secrets via headers only: drop ?key= and ?password= query fallbacks (#137, #141) #150

Merged

fen merged 1 commits from fix-137-141-drop-query-secrets into dev

2026-09-10 04:23:27 +00:00

Author	SHA1	Message	Date
fen	d013f3965f	Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137 , #141 ) CI / docker (pull_request) Skipped Details CI / test (pull_request) Successful in 28s Details Query strings leak into Traefik access logs, browser history, and Referer headers. Admin key is now accepted only via X-Admin-Key; paste and can passwords only via X-Paste-Password (or the POST unlock form). Tests updated; new negative cases assert 401 for the query paths.	2026-09-09 23:23:10 -05:00

Author

SHA1

Message

Date

fen

d013f3965f

Require secrets via headers only: drop ?key= and ?password= query fallbacks (#137 , #141 )

CI / docker (pull_request) Skipped

Details

CI / test (pull_request) Successful in 28s

Details

Query strings leak into Traefik access logs, browser history, and Referer
headers. Admin key is now accepted only via X-Admin-Key; paste and can
passwords only via X-Paste-Password (or the POST unlock form). Tests
updated; new negative cases assert 401 for the query paths.

2026-09-09 23:23:10 -05:00