Skip to content

Dashboard token travels in the URL query string #12

Description

@ThinkOffApp

The dashboard accepts its token either as an Authorization: Bearer header or as ?t=<token> on the URL, so a plain link works in a browser without typing anything. That convenience is doing real work — it is how the in-car link and the tunnel link stay one-tap — so this is a trade-off, not a bug.

The cost is that a URL-borne credential spreads in ways a header does not:

  • browser history and autocomplete on every device the link is opened on
  • server, proxy and tunnel access logs
  • screenshots and shared links — a screenshot of the dashboard address bar is the key to that car
  • Referer headers on any outbound link from the page

The token gates everything, including /api/update (see the companion issue), so treating it as a password rather than a URL parameter is worth doing.

Possible directions, roughly in order of effort:

  1. Accept ?t= once, then set it as a cookie and redirect to the clean URL, so the token stops appearing in the address bar and in history after the first load.
  2. Send Referrer-Policy: no-referrer so the token cannot leak outward via Referer.
  3. Keep query-string auth out of the logs — the access log line currently includes the full path.

Nothing here is urgent: the token is auto-generated, stored 0600, and compared in constant time, which is already better than most hobby dashboards do.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions