tursodatabase / libsql-shell-go

7 stars 7 forks source link

Don't pass the auth token in the database URL query string #125

Closed CodingDoug closed 11 months ago

CodingDoug commented 1 year ago

Currently, the provided auth token is added to the query string of the database URL. See addAuthTokenAsQueryParameter in internal/db/db.go. This can be problematic, especially if the URL gets logged somewhere. Instead, it should use the Authorization header of the HTTP request.

luisfvieirasilva commented 11 months ago

@CodingDoug Since go drivers only receive a single string, this is the way that libsql go driver use to receive the auth token (through URL query parameter). The drive internally parse it and use authorization header. Since this is the expected (and I only) way to do this, I'll close this issue, but please feel free to reopen if needed