[GH-ISSUE #145] SSE mecanism is a hack, not secure at all #1776

New Issue

GiteaMirror · 2026-05-20T14:23:31-05:00

GiteaMirror commented

2026-05-20 14:23:31 -05:00

Originally created by @dextmorgn on GitHub (May 10, 2026).
Original GitHub issue: https://github.com/reconurge/flowsint/issues/145

Flowsint uses SSE (Server Sent Events) to receive logs in the terminal in real time.
The EventSource JS api doesn't provide mechanisms to insert regular auth headers in the request (+ some more limitations).

Currently, we are passing the Auth token in the url directly. This is an assumed terrible practice, that needs to be addressed.

Considering fetch-event-source from Azure.

Originally created by @dextmorgn on GitHub (May 10, 2026). Original GitHub issue: https://github.com/reconurge/flowsint/issues/145 Flowsint uses SSE (Server Sent Events) to receive logs in the terminal in real time. The [EventSource](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events) JS api doesn't provide mechanisms to insert regular auth headers in the request (+ some more limitations). Currently, we are passing the Auth token in the url directly. This is an assumed terrible practice, that needs to be addressed. Considering [fetch-event-source from Azure](https://github.com/Azure/fetch-event-source).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/flowsint#1776