mirror of
https://github.com/sol1/rustguac.git
synced 2026-09-10 17:47:13 +00:00
211ff9e99a
API key users now exchange their key for a single-use 30-second ticket via POST /api/ws-ticket before connecting. The ticket is passed as ?ticket= in the WebSocket URL instead of the raw API key. Prevents API key exposure in reverse proxy logs, browser history, and Referer headers. Legacy ?key= still works as fallback.