From 9cb050233849ca7c8193a7e6d1570f966b1114f8 Mon Sep 17 00:00:00 2001 From: "j.foucher" Date: Sat, 2 May 2026 11:29:08 +0200 Subject: [PATCH] LicenseService: signed URL via ?key= instead of Authorization header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Apache FastCGI on OVH mutualisé strips Authorization headers before PHP sees them. The mod_rewrite [E=HTTP_AUTHORIZATION:%1] workaround in .htaccess does not survive on this hosting profile (probably because rewrite runs after the FastCGI handler accepts the request). The endpoint already accepts ?key= as a fallback path, so use that from the client. HTTPS still protects the key on the wire and the launcher never logs URLs containing the key. Co-Authored-By: Claude Opus 4.7 (1M context) --- src/PSLauncher.Core/Licensing/LicenseService.cs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/PSLauncher.Core/Licensing/LicenseService.cs b/src/PSLauncher.Core/Licensing/LicenseService.cs index f0c8ff4..c169212 100644 --- a/src/PSLauncher.Core/Licensing/LicenseService.cs +++ b/src/PSLauncher.Core/Licensing/LicenseService.cs @@ -158,11 +158,14 @@ public sealed class LicenseService : ILicenseService var key = GetDecryptedKey(); if (string.IsNullOrEmpty(key)) return null; - var url = TrimSlash(_serverBaseUrlProvider()) + "/download-url/" + version; + // On utilise ?key=… plutôt que le header Authorization parce que Apache OVH + // (et beaucoup de mutualisés FastCGI) strippe ce header avant qu'il atteigne + // PHP. La requête reste en HTTPS donc la clé n'est pas exposée sur le câble. + var encodedKey = Uri.EscapeDataString(key); + var url = TrimSlash(_serverBaseUrlProvider()) + "/download-url/" + version + "?key=" + encodedKey; try { using var req = new HttpRequestMessage(HttpMethod.Get, url); - req.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", key); using var resp = await _http.SendAsync(req, ct).ConfigureAwait(false); if (!resp.IsSuccessStatusCode) {