From 7675c9ad8e1236eb0320d8e643b0501e748332be Mon Sep 17 00:00:00 2001 From: LD-Reborn Date: Sat, 18 Jul 2026 18:25:14 +0200 Subject: [PATCH] docs: add documentation regarding the safety of query-string token usage --- README.md | 7 ++++++- src/ReverseLlama.Server/TokenAuthentication.cs | 6 ++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 5f1ccc7..f953954 100644 --- a/README.md +++ b/README.md @@ -136,4 +136,9 @@ The script ensures .NET 10 and Ollama are installed, builds the client self-cont ## Notes - Request and response bodies are streamed through the tunnel, which is important for Ollama streaming responses. -- Use HTTPS or a private network/VPN when exposing this outside a trusted network. The token is simple shared-secret protection, not a full access-control system. + +## Security notes + +- Use HTTPS or a private network/VPN when exposing this outside a trusted network. +- **Tokens in URLs** (`/token//...` and `?token=...`) are logged by web servers (Apache, Nginx, Kestrel), reverse proxies, and browsers (history). Malicious MITM proxies can also read them. Prefer header-based auth (`X-Reverse-Llama-Token` or `Authorization: Bearer`) when your client supports it. +- The token is simple shared-secret protection, not a full access-control system. diff --git a/src/ReverseLlama.Server/TokenAuthentication.cs b/src/ReverseLlama.Server/TokenAuthentication.cs index 2e8c502..f05e527 100644 --- a/src/ReverseLlama.Server/TokenAuthentication.cs +++ b/src/ReverseLlama.Server/TokenAuthentication.cs @@ -47,6 +47,9 @@ internal static class TokenAuthentication } } + // Path-token auth: useful for clients that cannot send headers. + // SECURITY: the token appears in the URL and will be logged by + // web servers, proxies, and browsers. Prefer header auth when possible. if (allowPathToken && TryGetPathToken(request.Path, out var pathToken, out _)) { @@ -57,6 +60,9 @@ internal static class TokenAuthentication } } + // Query-string auth: needed for clients that cannot send headers + // (e.g. browser address bar, status page). + // SECURITY: same URL-logging risks as path-token auth above. if (allowQueryToken && request.Query.TryGetValue("token", out var queryValues)) {