fix: don't use token in URL

Author: jmattheis

docs/more-pushmsg.md

@@ -11,16 +11,17 @@ All examples assume Gotify is running on `http://localhost:8008`. Replace `<appt
 TITLE="My Title"
 MESSAGE="Hello: ![](https://gotify.net/img/logo.png)"
 PRIORITY=5
-URL="http://localhost:8008/message?token=<apptoken>"
+TOKEN="<apptoken>"
+URL="http://localhost:8008/message"
 
-curl -s -S --data '{"message": "'"${MESSAGE}"'", "title": "'"${TITLE}"'", "priority":'"${PRIORITY}"', "extras": {"client::display": {"contentType": "text/markdown"}}}' -H 'Content-Type: application/json' "$URL"
+curl -s -S --data '{"message": "'"${MESSAGE}"'", "title": "'"${TITLE}"'", "priority":'"${PRIORITY}"', "extras": {"client::display": {"contentType": "text/markdown"}}}' -H 'Content-Type: application/json' -H "X-Gotify-Key: $TOKEN" "$URL"
 ```
 
 ## Python
 
 ```python
 import requests #pip install requests
-resp = requests.post('http://localhost:8008/message?token=<apptoken>', json={
+resp = requests.post('http://localhost:8008/message', headers={"X-Gotify-Key": "<apptoken>"}, json={
     "message": "Well hello there.",
     "priority": 2,
     "title": "This is my title"
@@ -35,11 +36,15 @@ package main
 import (
     "net/http"
     "net/url"
+    "strings"
 )
 
 func main() {
-    http.PostForm("http://localhost:8008/message?token=<apptoken>",
-        url.Values{"message": {"My Message"}, "title": {"My Title"}})
+    form := url.Values{"message": {"My Message"}, "title": {"My Title"}}
+    req, _ := http.NewRequest("POST", "http://localhost:8008/message", strings.NewReader(form.Encode()))
+    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+    req.Header.Set("X-Gotify-Key", "<apptoken>")
+    http.DefaultClient.Do(req)
 }
 ```
 
@@ -54,10 +59,11 @@ $data = [
 
 $data_string = json_encode($data);
 
-$url = "http://localhost:8008/message?token=<apptoken>";
+$url = "http://localhost:8008/message";
 
 $headers = [
-    "Content-Type: application/json; charset=utf-8"
+    "Content-Type: application/json; charset=utf-8",
+    "X-Gotify-Key: <apptoken>"
 ];
 
 $ch = curl_init();
@@ -98,7 +104,7 @@ switch ($code) {
 ```javascript
 const axios = require('axios');
 
-const url = 'http://localhost:8008/message?token=<apptoken>';
+const url = 'http://localhost:8008/message';
 const bodyFormData = {
   title: 'Hello from Javascript',
   message: 'Test Push Service from Node.js',
@@ -109,6 +115,7 @@ axios({
   method: 'post',
   headers: {
     'Content-Type': 'application/json',
+    'X-Gotify-Key': '<apptoken>',
   },
   url: url,
   data: bodyFormData,
@@ -157,11 +164,13 @@ public class GotifyClient {
     }
 
     private final String gotifyUrl;
+    private final String token;
     private final HttpClient httpClient;
     private final ObjectMapper objectMapper;
 
     public GotifyClient(String baseUrl, String token) {
-        this.gotifyUrl = String.format("%s/message?token=%s", baseUrl, token);
+        this.gotifyUrl = baseUrl + "/message";
+        this.token = token;
         this.httpClient = HttpClient.newHttpClient();
         this.objectMapper = new ObjectMapper();
     }
@@ -172,6 +181,7 @@ public class GotifyClient {
         final var request = HttpRequest.newBuilder()
                 .uri(URI.create(gotifyUrl))
                 .header("Content-Type", "application/json")
+                .header("X-Gotify-Key", token)
                 .POST(HttpRequest.BodyPublishers.ofString(bodyData))
                 .build();
 
@@ -205,7 +215,8 @@ public class GotifyClient {
 ## VB/VBA
 
 ```vb
-Const GOTIFY_URL As String = "http://localhost:8008/message?token=<apptoken>"
+Const GOTIFY_URL As String = "http://localhost:8008/message"
+Const GOTIFY_TOKEN As String = "<apptoken>"
 
 '--- Based on pushover-vba by Mauricio Arieira (https://github.com/makah/pushover-vba)
 Public Function PushToGotify(ByVal title As String, ByVal message As String, ByVal priority As Integer) As String
@@ -215,6 +226,7 @@ Public Function PushToGotify(ByVal title As String, ByVal message As String, ByV
     With xhttp
         .Open "POST", GOTIFY_URL, False
         .setRequestHeader "Content-type", "application/x-www-form-urlencoded"
+        .setRequestHeader "X-Gotify-Key", GOTIFY_TOKEN
         .Send params
         PushToGotify = .responseText
     End With
@@ -234,5 +246,5 @@ subject="wget"
 message="Test push from wget"
 priority=5
 
-wget "http://localhost:8008/message?token=$token" --post-data "title=$subject&message=$message&priority=$priority" -O /dev/null
+wget "http://localhost:8008/message" --header "X-Gotify-Key: $token" --post-data "title=$subject&message=$message&priority=$priority" -O /dev/null
 ```

docs/pushmsg.md

@@ -13,15 +13,15 @@ The token is returned when creating the application. Starting with Gotify 3, tok
 Now you can use [curl](https://curl.se/), [HTTPie](https://httpie.io/) or any other HTTP client to push messages.
 
 ```bash
-$ curl "https://push.example.de/message?token=<apptoken>" -F "title=my title" -F "message=my message" -F "priority=5"
-$ http -f POST "https://push.example.de/message?token=<apptoken>" title="my title" message="my message" priority="5"
+$ curl "https://push.example.de/message" -H "X-Gotify-Key: <apptoken>" -F "title=my title" -F "message=my message" -F "priority=5"
+$ http -f POST "https://push.example.de/message" "X-Gotify-Key:<apptoken>" title="my title" message="my message" priority="5"
 ```
 
 On Microsoft PowerShell, you can use the built-in `Invoke-RestMethod` or `Invoke-WebRequest` cmdlets.
 
 ```powershell
-PS> Invoke-RestMethod -Uri "https://push.example.de/message?token=<apptoken>" -Method POST -Body @{title="my title"; message="my message"; priority=5} # return is automatically parsed into a PowerShell object
-PS> Invoke-WebRequest -Uri "https://push.example.de/message?token=<apptoken>" -Method POST -Body @{title="my title"; message="my message"; priority=5} # return is as raw response
+PS> Invoke-RestMethod -Uri "https://push.example.de/message" -Headers @{"X-Gotify-Key"="<apptoken>"} -Method POST -Body @{title="my title"; message="my message"; priority=5} # return is automatically parsed into a PowerShell object
+PS> Invoke-WebRequest -Uri "https://push.example.de/message" -Headers @{"X-Gotify-Key"="<apptoken>"} -Method POST -Body @{title="my title"; message="my message"; priority=5} # return is as raw response
 ```
 
 > The message API takes an `extras` property that carries extra information with the message and describes how clients should handle it.