Files
rustguac/static
Dave Kempe 211ff9e99a WebSocket ticket auth: keep API keys out of WS URLs
API key users now exchange their key for a single-use 30-second
ticket via POST /api/ws-ticket before connecting. The ticket is
passed as ?ticket= in the WebSocket URL instead of the raw API key.

Prevents API key exposure in reverse proxy logs, browser history,
and Referer headers. Legacy ?key= still works as fallback.
2026-03-28 22:22:05 +11:00
..
2026-02-06 14:38:53 +11:00
2026-03-28 12:27:42 +11:00