[ehfd]

• Needs selkies-project/selkies@44f4832, in Selkies 2.1.0, which takes the session token from the URL fragment.

Rebased on main, where the 2.1.0 sync (6ea2f4c, 07abf8d) already documents the token in the fragment, /api/tokens in place of the 8083 control port, the api location, the print spool's default, PAPERSIZE, and the interposer sockets in XDG_RUNTIME_DIR, so those changes are dropped. What the protocol page still lacked:

• The data WebSocket is at <subfolder>api/websockets, where the page still had the v1 images' <subfolder>websocket.
• A fragment token can follow a role or display keyword, #display2-right&token=<token>.
• A caller behind a Basic login presents the master token in Selkies-Authorization; Authorization is tried first.

Tested:

• mkdocs build --strict after rebasing on main (with docs/requirements.txt and d2 0.9.0): no warnings or errors.
• Against Selkies 2.1.0's source: stream_server.py takes the master token from Selkies-Authorization when Authorization does not carry it, and the web client's page-url.js reads token= beside a keyword in either order.
• Before the rebase, Selkies main (3291323) behind the port 3000 server block of the baseimage's root/defaults/default.conf (master), with its placeholders filled as init-nginx fills them, in nginx 1.31.6: in Chrome, Firefox, and WebKit, /#token= streams, the socket request is GET /api/websockets offering selkies, selkies.token.* and answered 101 with selkies, and no request line or Referer that nginx logged carries the token. POST /api/tokens through nginx answers 200. The same holds under a subfolder with the block's auth_basic lines enabled, as PASSWORD enables them, behind a proxy that sets the container's Basic login on every request, as SealSkin's Caddy does. ?token= streams as before.
• Before the rebase, in ghcr.io/linuxserver/webtop:ubuntu-kde itself, running Selkies main (1251515) through the image's dev mode (DEV_MODE=selkies-dashboard): in Chrome 154, Firefox 156, and WebKit, /#token= streams the KDE desktop, the socket request is GET /api/websockets with no query, and no line of the image's nginx access log or of the container's log carries the token. ?token= streams as before.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[ehfd]

@thelamer