Re: [PATCH proxmox/yew-pwt/datacenter-manager/installer v3 00/38] add auto-installer integration

["Lukas Wagner" <l.wagner@proxmox.com>]

On Mon Apr 20, 2026 at 2:26 PM CEST, Christoph Heiss wrote:
>>>
>>>  From my point of view, both points can be solved by using distinct
>>> tokens. The first point is solved by making the new type of token
>>> unusable in any other context by design. For the second issue, I think
>>> due to the fact that the token is *only* usable in this context, we
>>> could afford to return it from the API or as a downloadable ISO,
>>> assuming the user has high-enough permissions.
>>>
>>> What do you think?
>>>
>>> Regarding the 'custom token' itself, one thing that we could do is to
>>> make the token a regular parameter on the POST call, instead of using
>>> the 'Authorization' header. This would avoid API users from being
>>> confused about why there is one API route that uses a *different* token
>>> for no clearly visible reason.
>
> This actually was a point I discussed with Aaron early on while fleshing
> out a rough implementation plan for this.
> The argument for using the 'Authorization' header was that this header
> is treated with the required sensitivity (or hopefully, at least) in
> middlewares such as reverse proxies, i.e. most importantly not logging
> it somewhere with the whole URL.

Good point, that's something I haven't really considered.

>
> If we put the token into the URL as a (query?) parameter, there's a good
> chance it will get logged somewhere. So I'm quite opposed to putting it
> into the URL.

A *query* parameter for a POST request is rather odd, no? As usually
any data needed for the request would be put into the request body,
either form-encoded or as a JSON body.

As far as I'm aware it's not really that common for any kind of logging
to log the full request body, but of course that still does not rule it
out completely - so your point with regards to using 'Authorization'
still stands.

With the separate token/secret system it is probably a manageable risk
though, so it still *could* be okay to pass the secret in the body.