Documentation
¶
Index ¶
Constants ¶
View Source
const AuthKeyHeader = "X-AuthKey"
View Source
const AuthKeyQueryParam = "authkey"
AuthKeyQueryParam carries the key for requests that cannot set a header.
Under Electron every request gets X-AuthKey injected by a session.webRequest handler. Neither Tauri nor Wails can do that, so subresource loads a webview issues on its own — <img>, <video>, markdown images, streaming preview — have no way to present a header. Those URLs carry the key as a query parameter instead.
View Source
const WaveAuthKeyEnv = "SLTERM_AUTH_KEY"
Variables ¶
This section is empty.
Functions ¶
func GetAuthKey ¶
func GetAuthKey() string
func SetAuthKeyFromEnv ¶
func SetAuthKeyFromEnv() error
func ValidateIncomingRequest ¶
ValidateIncomingRequest accepts the key from either the header or the query parameter. The comparison is constant-time: the key is a shared secret and a byte-wise early return leaks its prefix to anything that can time requests to the loopback listener.
Types ¶
This section is empty.
Source Files
Click to show internal directories.
Click to hide internal directories.