Merged in backlog/use-header-to-pass-credentials-from-api (pull reque…

…st #281) use headers instead of get vars for auth Approved-by: Eric Hermelin Approved-by: Patrick Boucher
ftrackhq · Oct 3, 2022 · 8832bf1 · 8832bf1
2 parents 53c221e + 01c7b9c
commit 8832bf1
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 4 deletions.
diff --git a/doc/release/release_notes.rst b/doc/release/release_notes.rst
@@ -11,6 +11,11 @@ Release Notes
 
 .. release:: Upcoming
 
+    .. change:: changed
+        :tags: events, security
+
+        Auth info sent via request headers instead of GET variables.
+
     .. change:: fixed
         :tags: documentation
 

diff --git a/source/ftrack_api/event/hub.py b/source/ftrack_api/event/hub.py
@@ -839,16 +839,18 @@ def subscription(self, subscription, callback, subscriber=None,
     def _get_socket_io_session(self):
         '''Connect to server and retrieve session information.'''
         socket_io_url = (
-            '{0}://{1}/socket.io/1/?api_user={2}&api_key={3}'
+            '{0}://{1}/socket.io/1/'
         ).format(
             self.server.scheme,
-            self.get_network_location(),
-            self._api_user,
-            self._api_key
+            self.get_network_location()
         )
         try:
             response = requests.get(
                 socket_io_url,
+                headers={
+                    'ftrack-user': self._api_user,
+                    'ftrack-api-key': self._api_key
+                },
                 timeout=60  # 60 seconds timeout to recieve errors faster.
             )
         except requests.exceptions.Timeout as error: