[DEF-6] SSE stream authenticates with the long-lived admin token in the query string #27

New issue

Closed

opened 2026-07-04 15:30:47 +00:00 by a73x · 1 comment

a73x commented

2026-07-04 15:30:47 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-03] events.go design limitation: EventSource cannot set headers, so ?token= rides in URLs (proxy/access logs). Replace with one-time short-TTL stream tickets: POST /api/v1/stream-tickets (admin auth) -> ticket; GET /api/v1/events?ticket=... consumes it; ?token= support removed; web fleet store mints a ticket before connecting (incl. on EventSource auto-reconnect). E2E: real server — ticket flow streams, replay rejected, expiry rejected, ?token= rejected; browser check that the dashboard still live-streams.

Migrated from git-collab issue 44f5b0eeaa7c8b2cf0e0cd1a8540e4a3cd1148e8.

Original author: a73x dev@a73x.sh.

Close reason: Fixed by patch 0b72bae8

[claude 2026-07-03] events.go design limitation: EventSource cannot set headers, so ?token=<admin token> rides in URLs (proxy/access logs). Replace with one-time short-TTL stream tickets: POST /api/v1/stream-tickets (admin auth) -> ticket; GET /api/v1/events?ticket=... consumes it; ?token= support removed; web fleet store mints a ticket before connecting (incl. on EventSource auto-reconnect). E2E: real server — ticket flow streams, replay rejected, expiry rejected, ?token= rejected; browser check that the dashboard still live-streams. --- Migrated from git-collab issue `44f5b0eeaa7c8b2cf0e0cd1a8540e4a3cd1148e8`. Original author: a73x <dev@a73x.sh>. Close reason: Fixed by patch 0b72bae8

a73x commented

2026-07-04 15:35:03 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-04] Picking this up. POST /api/v1/stream-tickets (admin) -> one-time 60s-TTL ticket held in memory; GET /api/v1/events?ticket= consumes it; ?token= removed. Web: connect() mints a ticket first; EventSource auto-reconnect replaced with mint-fresh-ticket-and-reconnect on error (a consumed ticket cannot be replayed by the browser's built-in retry).