- Shipped
- August 26, 2026 at 3:16 AM UTC
- Author
- Kamo
- Commit
- 22dbfe1
Closing the KamoDesktop tab left a live session sitting on the machine. Guacamole keeps its auth token in localStorage (GUAC_AUTH), which survives closing the tab, closing the window and restarting the browser, and the token stays valid for 60 minutes past its last use. So the next person to open the gateway on that computer inherited the previous person's desktop. Reproduced end to end. Two changes, deliberately both server-side first. The edge now redirects a bare document request to login.kamocrm.com. KamoDesktop has exactly one legitimate entry point — a signed, single-use link minted for someone already authenticated to Kamo — so a person typing the hostname, or restoring a bookmark, or letting the browser autocomplete it, has no business seeing Guacamole's password box. Serving one offers a credential-stuffing target for the `sage` account and lets a browser holding a live token silently resume a session. Scoped to Path(`/`) on purpose: a cold SPA load pulls ~41 assets and API calls that carry no ?data=, so anything broader breaks the application outright. The #/client/... fragment never reaches the server, so a bookmarked deep link is a bare `/` here and is bounced too — which is correct. And the token is now revoked when the tab goes away, rather than merely forgotten: DELETE /api/session with the Guacamole-Token header (verified live — 204, and the token stops working immediately). Skipped for a bfcache freeze, so pressing Back does not sign anyone out. kamo-reconnect.js is gone. It existed to paper over dropped sessions, it took the desktop down twice, and the causes it was compensating for — deploys restarting the gateway, and the OOM — are fixed at their source. What replaces it is a quarter of the size and its worst failure is that you are signed out, which is the outcome it is trying to produce.