Remove ?token= deletion-token path (#143)

Conversation 0 Commits 2 Files Changed 9

+202 -41

2 Commits

Author	SHA1	Message	Date
fen	00aaafeb3c	#143 : set tok_<id> cookie in create handlers so the created banner can show the token (QA) CI / docker (pull_request) Skipped Details CI / test (pull_request) Successful in 29s Details	2026-09-10 08:37:07 -05:00
fen	d7b51f02b6	Remove ?token= deletion-token path (#143 ) The deletion token was accepted via the ?token= query parameter on both DELETE /api/pastes/{id} and /redeem, and round-tripped through the paste URL after creation. URL-carried bearer secrets leak into reverse-proxy access logs and browser history. - API: deletion tokens are now accepted only via the Authorization header (Bearer/Token/bare); query params are ignored on both endpoints - Web create flow: token moves to the browser via a short-lived tok_<id> HttpOnly cookie instead of the redirect URL; the paste view reads it from the cookie, never from ?token= - Web view: the delete button calls redeem() which takes the token from sessionStorage and sends it as an Authorization header - Tests: correct token in query must be rejected (403/400); header path still deletes/redeems; extraction unit cases updated Fixes #143	2026-09-10 08:37:07 -05:00

Author

SHA1

Message

Date

fen

00aaafeb3c

#143 : set tok_<id> cookie in create handlers so the created banner can show the token (QA)

CI / docker (pull_request) Skipped

Details

CI / test (pull_request) Successful in 29s

Details

2026-09-10 08:37:07 -05:00

fen

d7b51f02b6

Remove ?token= deletion-token path (#143 )

The deletion token was accepted via the ?token= query parameter on both
DELETE /api/pastes/{id} and /redeem, and round-tripped through the paste
URL after creation. URL-carried bearer secrets leak into reverse-proxy
access logs and browser history.

- API: deletion tokens are now accepted only via the Authorization header
  (Bearer/Token/bare); query params are ignored on both endpoints
- Web create flow: token moves to the browser via a short-lived tok_<id>
  HttpOnly cookie instead of the redirect URL; the paste view reads it
  from the cookie, never from ?token=
- Web view: the delete button calls redeem() which takes the token from
  sessionStorage and sends it as an Authorization header
- Tests: correct token in query must be rejected (403/400); header path
  still deletes/redeems; extraction unit cases updated

Fixes #143

2026-09-10 08:37:07 -05:00

Remove ?token= deletion-token path (#143) #153