[jira] [Closed] (GUACAMOLE-1775) Auth token as a parameter in "session/tunnels//protocol" request

["Mike Jumper (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/GUACAMOLE-1775?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mike Jumper closed GUACAMOLE-1775.
----------------------------------
    Fix Version/s: 1.6.0
       Resolution: Fixed

> Auth token as a parameter in "session/tunnels/<tunnel ID>/protocol" request
> ---------------------------------------------------------------------------
>
>                 Key: GUACAMOLE-1775
>                 URL: https://issues.apache.org/jira/browse/GUACAMOLE-1775
>             Project: Guacamole
>          Issue Type: Bug
>          Components: guacamole, guacamole-client
>    Affects Versions: 1.4.0, 1.5.0
>            Reporter: Ares
>            Priority: Trivial
>             Fix For: 1.6.0
>
>   Original Estimate: 2h
>  Remaining Estimate: 2h
>
> The following HTTP requests example generated by Guacamole client contains authentication service tokens via URL query parameters, which could be leaked from server log files, “Referer header” of HTTP request, etc. 
> Example: GET /api/session/tunnels/<tunnel ID>/protocol?token=<token>
>  
> This has been found in 1.4.0 and 1.5.0. 
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)