Flowsint uses SSE (Server Sent Events) to receive logs in the terminal in real time.
The EventSource JS api doesn't provide mechanisms to insert regular auth headers in the request (+ some more limitations).
Currently, we are passing the Auth token in the url directly. This is an assumed terrible practice, that needs to be addressed.
Originally created by @dextmorgn on GitHub (May 10, 2026).
Original GitHub issue: https://github.com/reconurge/flowsint/issues/145
Flowsint uses SSE (Server Sent Events) to receive logs in the terminal in real time.
The [EventSource](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events) JS api doesn't provide mechanisms to insert regular auth headers in the request (+ some more limitations).
Currently, we are passing the Auth token in the url directly. This is an assumed terrible practice, that needs to be addressed.
Considering [fetch-event-source from Azure](https://github.com/Azure/fetch-event-source).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @dextmorgn on GitHub (May 10, 2026).
Original GitHub issue: https://github.com/reconurge/flowsint/issues/145
Flowsint uses SSE (Server Sent Events) to receive logs in the terminal in real time.
The EventSource JS api doesn't provide mechanisms to insert regular auth headers in the request (+ some more limitations).
Currently, we are passing the Auth token in the url directly. This is an assumed terrible practice, that needs to be addressed.
Considering fetch-event-source from Azure.