From c10615a16458a8c3395f7a142946c6d41620c6ef Mon Sep 17 00:00:00 2001
From: Marcus Kida <marcus.kida@bearologics.com>
Date: Tue, 10 Feb 2026 11:01:41 +0100
Subject: [PATCH] Remove auth token query param fallback

---
 admin.go | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/admin.go b/admin.go
index 13f26d8..0ae1ff4 100644
--- a/admin.go
+++ b/admin.go
@@ -10,13 +10,7 @@ import (
 
 func adminAuth(token string, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		auth := r.Header.Get("Authorization")
-		if auth == "Bearer "+token {
-			next.ServeHTTP(w, r)
-			return
-		}
-		// For the HTML page, allow token via query param so it can be bookmarked
-		if r.URL.Query().Get("token") == token {
+		if r.Header.Get("Authorization") == "Bearer "+token {
 			next.ServeHTTP(w, r)
 			return
 		}