From 8127d64f44d9648d166054d64bd399ece0751310 Mon Sep 17 00:00:00 2001 From: Paul Wells Date: Wed, 16 Sep 2026 16:06:55 -0700 Subject: [PATCH] auth: name the call the query-string read avoids The token comes from RawQuery so the body reaches a proxied agent endpoint intact. That only holds as long as nobody reaches for FormValue, which is the obvious way to read a param and the one that drains the body, so the comment names it. --- pkg/service/auth.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/pkg/service/auth.go b/pkg/service/auth.go index 73fd0b948..d6122dde7 100644 --- a/pkg/service/auth.go +++ b/pkg/service/auth.go @@ -76,9 +76,8 @@ func (m *APIKeyAuthMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request, authToken = authHeader[len(bearerPrefix):] } else { - // the body must survive for requests proxied further (agent HTTP - // endpoints), so the token comes from the query string alone. URL is nil - // on hand-built requests. + // fall back to the query string rather than a form body, which must + // survive intact for requests proxied further (agent HTTP endpoints). if r.URL != nil { authToken = r.URL.Query().Get(accessTokenParam) }