22 lines
956 B
Markdown
22 lines
956 B
Markdown
# Why tokens aren’t in URLs
|
||
|
||
A runner URL like `/run/bot_abc` is safe to bookmark, screenshot, and paste. A URL like `/run/bot_abc?token=Bot%20MTk…` is a leak:
|
||
|
||
- Browser history
|
||
- Crash reports
|
||
- Referrer headers
|
||
- Shoulder surfing
|
||
- `pm2 logs` / reverse-proxy access logs if you self-host poorly
|
||
|
||
TabBot therefore:
|
||
|
||
1. Opens `/run/:botId` with **no** search string
|
||
2. Sends the token **and named-secret bag** over `postMessage` / `BroadcastChannel` after a nonce handshake
|
||
3. Holds a copy in the runner’s `sessionStorage` until the tab dies
|
||
|
||
Named secrets (`llm/apiKey`, `translation/apiKey`, anything you add in Settings) follow the same rule: not in URLs, share codes, git, or Discord. See [Named secrets](/docs/guide/named-secrets).
|
||
|
||
If you ever see `token=` on a TabBot URL, stop, rotate the Discord token, and file a bug. Do not send the leaked token to HoneyPeer.
|
||
|
||
Invite URLs use `client_id` and `permissions` only. That is not a bot token.
|