From fcaab0e3f00501fb90be06dcb8643d2f48a17c35 Mon Sep 17 00:00:00 2001 From: M57 Date: Thu, 18 Jun 2026 02:33:22 +0300 Subject: [PATCH] docs: document LAN-only http:// assumption in AuthManager --- .../java/com/m57/hermescontrol/data/local/AuthManager.kt | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/app/src/main/java/com/m57/hermescontrol/data/local/AuthManager.kt b/app/src/main/java/com/m57/hermescontrol/data/local/AuthManager.kt index 8c06c465..b2049be1 100644 --- a/app/src/main/java/com/m57/hermescontrol/data/local/AuthManager.kt +++ b/app/src/main/java/com/m57/hermescontrol/data/local/AuthManager.kt @@ -109,9 +109,12 @@ object AuthManager { requirePrefs().edit().putString(KEY_THEME_PREFERENCE, theme.name).apply() } - /** Convenience: build the base URL from current host + port. */ + /** Convenience: build the base URL from current host + port. + * NOTE: Uses plain http:// — intended for trusted local network only. + * Exposing the host to a hostile LAN risks token interception. */ fun baseUrl(): String = "http://${getHost()}:${getPort()}/" - /** Convenience: build the WebSocket URL with token query param. */ + /** Convenience: build the WebSocket URL with token query param. + * NOTE: Token in query string — trusted local network only. */ fun wsUrl(): String = "ws://${getHost()}:${getPort()}/api/ws?token=${getToken().orEmpty()}" }