{"record":{"id":"c43114a69756f8f0","repo":"hashicorp/vagrant","slug":"cloud-command-middleware-authentication-different","errorCode":null,"errorMessage":"cloud_command.middleware.authentication.different_target","messagePattern":"cloud_command\\.middleware\\.authentication\\.different_target","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/commands/cloud/auth/middleware/add_authentication.rb","lineNumber":67,"sourceCode":"                u.to_s\n              else\n                url\n              end\n            rescue URI::Error\n              url\n            end\n          end\n\n          server_uri = URI.parse(Vagrant.server_url.to_s)\n\n          if token && !server_uri.host.to_s.empty?\n            env[:box_urls].map! do |url|\n              begin\n                u = URI.parse(url)\n\n                if u.host == server_uri.host\n                  if server_uri.host != TARGET_HOST && !self.class.custom_host_notified?\n                    env[:ui].warn(I18n.t(\"cloud_command.middleware.authentication.different_target\",\n                      custom_host: server_uri.host, known_host: TARGET_HOST) + \"\\n\")\n                    sleep CUSTOM_HOST_NOTIFY_WAIT\n                    self.class.custom_host_notified!\n                  end\n\n                  q = CGI.parse(u.query || \"\")\n\n                  current = q[\"access_token\"]\n                  if current && current.empty?\n                    q[\"access_token\"] = token\n                  end\n\n                  u.query = URI.encode_www_form(q)\n                end\n\n                u.to_s\n              rescue URI::Error\n                url","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/plugins/commands/cloud/auth/middleware/add_authentication.rb#L49-L85","documentation":"Security-conscious warning from the cloud auth middleware (add_authentication.rb) injected into box-add/download action chains. When a token exists and the configured Vagrant server URL (Vagrant.server_url) points at a host other than the known Vagrant Cloud target (TARGET_HOST), the middleware is about to append that access token to box URLs for the custom host, so it warns that your credential will be sent to the custom server, shows both hostnames, sleeps CUSTOM_HOST_NOTIFY_WAIT, and flags self.class.custom_host_notified! so it warns only once.","triggerScenarios":"VAGRANT_SERVER_URL (or a config setting server_url) is set to a custom/mirror host while a Vagrant Cloud token is stored (via `vagrant cloud auth login`), and you then run a box operation (vagrant box add / vagrant up needing download) whose box_urls include that custom host.","commonSituations":"Air-gapped or mirrored environments using an internal Vagrant Cloud clone; developers switching between Vagrant Cloud and a company catalog and forgetting they hold a production token; CI images that pre-login and also set VAGRANT_SERVER_URL, unknowingly shipping the token to the mirror.","solutions":["If the custom server should NOT receive your token, unset it before the operation: `vagrant cloud auth logout` (removes the stored token) or unset VAGRANT_SERVER_URL.","Verify which host is in play: `echo $VAGRANT_SERVER_URL` and compare with the known_host printed in the warning.","If the custom server legitimately needs the token (private mirror), accept the warning; it fires once per process thanks to custom_host_notified!.","For shared/CI machines, scope tokens per server and revoke any token that may have reached an untrusted mirror."],"exampleFix":"# before\nexport VAGRANT_SERVER_URL=https://mirror.internal.example\nvagrant up   # token gets injected into mirror box URLs -> warning\n\n# after (no token leakage to mirror)\nexport VAGRANT_SERVER_URL=https://mirror.internal.example\nvagrant cloud auth logout 2>/dev/null || true\nvagrant up","handlingStrategy":"validation","validationCode":"require \"uri\"\nserver = URI.parse(ENV['VAGRANT_SERVER_URL'] || 'https://vagrantcloud.com')\ntoken_exists = File.exist?(File.join(ENV['VAGRANT_HOME'] || File.join(Dir.home, '.vagrant.d'), 'data', 'cloud-token'))\nif token_exists && server.host != 'vagrantcloud.com'\n  warn \"token would be sent to custom host #{server.host}; unset VAGRANT_SERVER_URL or log out\"\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never set VAGRANT_SERVER_URL and store a production token on the same machine unless the mirror is trusted.","Use scoped, revocable tokens per environment.","Watch for this warning in CI logs as a leak detector; rotate the token if it appears unexpectedly."],"tags":["vagrant","vagrant-cloud","authentication","token-security","custom-server"],"backgroundTag":"auth-token-sent-to-custom-server","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}