{"record":{"id":"e5f6c858315f42f2","repo":"hashicorp/vagrant","slug":"cloud-command-middleware-authentication-different-e5f6c8","errorCode":null,"errorMessage":"cloud_command.middleware.authentication.different_target","messagePattern":"cloud_command\\.middleware\\.authentication\\.different_target","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/commands/cloud/auth/middleware/add_downloader_authentication.rb","lineNumber":45,"sourceCode":"          client = Client.new(env[:env])\n          token  = client.token\n          Vagrant::Util::CredentialScrubber.sensitive(token)\n\n          begin\n            target_url = URI.parse(env[:downloader].source)\n            if target_url.host != TARGET_HOST && REPLACEMENT_HOSTS.include?(target_url.host)\n              target_url.host = TARGET_HOST\n              env[:downloader].source = target_url.to_s\n            end\n          rescue URI::Error\n            # if there is an error, use current target_url\n          end\n\n          server_uri = URI.parse(Vagrant.server_url.to_s)\n          if token && !server_uri.host.to_s.empty?\n            if target_url.host == server_uri.host\n              if server_uri.host != TARGET_HOST && !self.class.custom_host_notified?\n                env[:ui].warn(I18n.t(\"cloud_command.middleware.authentication.different_target\",\n                  custom_host: server_uri.host, known_host: TARGET_HOST) + \"\\n\")\n                sleep CUSTOM_HOST_NOTIFY_WAIT\n                self.class.custom_host_notified!\n              end\n\n              if Array(env[:downloader].headers).any? { |h| h.include?(\"Authorization\") }\n                @logger.info(\"Not adding an authentication header, one already found\")\n              else\n                env[:downloader].headers << \"Authorization: Bearer #{token}\"\n              end\n            else\n              @logger.debug(\"Not adding authentication header, host mismatch #{target_url.host} != #{server_uri.host}\")\n            end\n\n            env[:downloader]\n          end\n        end\n","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/plugins/commands/cloud/auth/middleware/add_downloader_authentication.rb#L27-L63","documentation":"Same 'different_target' warning, emitted by the downloader-oriented twin middleware (add_downloader_authentication.rb) that decorates env[:downloader] before a file download. After rewriting known replacement hosts to TARGET_HOST, it checks that the download target host equals the configured server_url host; if that host is not the official TARGET_HOST, it warns that the stored token will be attached as an Authorization: Bearer header for that custom host (unless an Authorization header is already present), sleeps the notification wait, and marks the warning as shown for the class.","triggerScenarios":"A stored cloud token plus VAGRANT_SERVER_URL pointing to a non-official host, combined with any action that downloads a box file through the downloader middleware (vagrant box add from the catalog, vagrant up first run, vagrant box update).","commonSituations":"Corporate mirrors fronting Vagrant Cloud; debugging with a local proxy server URL; environments where REPLACEMENT_HOSTS rewrite alt hostnames to TARGET_HOST but the operator's server_url is custom, producing token-bearing uploads to infrastructure the token was never issued for.","solutions":["Decide intent: for a trusted private mirror keep the token; otherwise `vagrant cloud auth logout` or unset VAGRANT_SERVER_URL before downloading.","Check for an existing Authorization header if you inject your own auth in downloader headers — the middleware skips adding the token when one is present.","Rotate the token (`vagrant cloud auth login` again) if it was ever sent to a host you do not control.","Silence-free alternative: download the box file anonymously (box add with an explicit URL) so no token is involved."],"exampleFix":"# before\nVAGRANT_SERVER_URL=https://internal-mirror.corp vagrant box add corp/base-box\n# -> warning: Bearer token will be sent to internal-mirror.corp\n\n# after\nvagrant cloud auth logout\nVAGRANT_SERVER_URL=https://internal-mirror.corp vagrant box add corp/base-box","handlingStrategy":"validation","validationCode":"require \"uri\"\ntarget = URI.parse(box_download_url)\nserver = URI.parse(ENV['VAGRANT_SERVER_URL'] || 'https://vagrantcloud.com')\nraise \"token would target custom host #{server.host}\" if target.host == server.host && server.host != 'vagrantcloud.com'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set your own Authorization header when downloading through a proxy that must not see the Vagrant token — the middleware skips injection when one exists.","Unset VAGRANT_SERVER_URL for anonymous catalog downloads.","Rotate any token flagged by this warning and audit mirror logs for its use."],"tags":["vagrant","vagrant-cloud","downloader","bearer-token","custom-server"],"backgroundTag":"auth-token-sent-to-custom-server","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}