API token accepted via URL query parameter (?token=) is logged by proxies

[ThiagoBauken]

Summary

authalice accepts the API token from the URL query string as a fallback. Query strings are routinely captured by reverse-proxy/access logs, browser history, and Referer headers — leaking long-lived credentials.

Details

// handlers.go:156-158
token := r.Header.Get("token")
if token == "" {
    token = strings.Join(r.URL.Query()["token"], "")
}

Any call made as ...?token=<secret> records the token in plaintext in nginx/Caddy/Traefik access logs, etc.

Proposed fix

Deprecate query-string auth. Removing it outright would break integrations that can't set headers, so suggest a transition:

• log a deprecation warning when a token arrives via query, document header-only usage, then remove in a later release; or
• if a credential must be URL-passable, issue a separate short-lived token instead of the long-lived API token.

Location

• handlers.go:156-158

Happy to PR whichever path you prefer.

[ThiagoBauken]

I have a small, non-breaking PR ready for the immediate leak: redact the token query parameter in the access log (the logged URL shows token=REDACTED instead of the secret). Query-string auth keeps working exactly as today — the token just stops landing in nginx/Caddy/Traefik access logs. Covered by a unit test.

That's the low-risk first step that closes the actual leak without touching anyone's integration. The fuller change you mention in the issue (deprecating query-string auth entirely) is more invasive and would want a deprecation window — I'm happy to follow up with that separately if you want it.

Want me to send the redaction PR now?