Authorization as header instead of query parameter

[matthiasemde]

Hi,

I want to set up Immich Frame + Frameo devices with a public endpoint (I want to gift picture frames to family + friends and have them connect to Immich Frame on my home server).
I was wondering if there is a reason why the authSecret is placed into the query parameters instead of an 'Authorization' header. As I understand it, this means that the secret could get exposed whereas in the header it would be encrypted under https.

If you think that this is possible, I'd be willing to try and contribute the feature to the app :)

Best wishes
Matthias

[dave-palt]

@matthiasemde https encrypts both headers and query params equally, the only difference could be in client/server logs IF the full url is printed and not obfuscated.

I still agree with you to send it in the headers, so if you have time make the pr as I am pretty sure it is possible https://github.com/immich-app/immich/blob/main/open-api/immich-openapi-specs.json#L15375-L15389

[3rob3]

It has been awhile, but I feel like I couldn't get it working in the header so gave up and went with query. Non-webview mode does use Header method.