cloud_command.middleware.authentication.different_target

Error message

cloud_command.middleware.authentication.different_target

What it means

Same 'different_target' warning, emitted by the downloader-oriented twin middleware (add_downloader_authentication.rb) that decorates env[:downloader] before a file download. After rewriting known replacement hosts to TARGET_HOST, it checks that the download target host equals the configured server_url host; if that host is not the official TARGET_HOST, it warns that the stored token will be attached as an Authorization: Bearer header for that custom host (unless an Authorization header is already present), sleeps the notification wait, and marks the warning as shown for the class.

Source

Thrown at plugins/commands/cloud/auth/middleware/add_downloader_authentication.rb:45

          client = Client.new(env[:env])
          token  = client.token
          Vagrant::Util::CredentialScrubber.sensitive(token)

          begin
            target_url = URI.parse(env[:downloader].source)
            if target_url.host != TARGET_HOST && REPLACEMENT_HOSTS.include?(target_url.host)
              target_url.host = TARGET_HOST
              env[:downloader].source = target_url.to_s
            end
          rescue URI::Error
            # if there is an error, use current target_url
          end

          server_uri = URI.parse(Vagrant.server_url.to_s)
          if token && !server_uri.host.to_s.empty?
            if target_url.host == server_uri.host
              if server_uri.host != TARGET_HOST && !self.class.custom_host_notified?
                env[:ui].warn(I18n.t("cloud_command.middleware.authentication.different_target",
                  custom_host: server_uri.host, known_host: TARGET_HOST) + "\n")
                sleep CUSTOM_HOST_NOTIFY_WAIT
                self.class.custom_host_notified!
              end

              if Array(env[:downloader].headers).any? { |h| h.include?("Authorization") }
                @logger.info("Not adding an authentication header, one already found")
              else
                env[:downloader].headers << "Authorization: Bearer #{token}"
              end
            else
              @logger.debug("Not adding authentication header, host mismatch #{target_url.host} != #{server_uri.host}")
            end

            env[:downloader]
          end
        end

View on GitHub (pinned to 35f3160f4a)

Solutions

Decide intent: for a trusted private mirror keep the token; otherwise `vagrant cloud auth logout` or unset VAGRANT_SERVER_URL before downloading.
Check for an existing Authorization header if you inject your own auth in downloader headers — the middleware skips adding the token when one is present.
Rotate the token (`vagrant cloud auth login` again) if it was ever sent to a host you do not control.
Silence-free alternative: download the box file anonymously (box add with an explicit URL) so no token is involved.

Example fix

# before
VAGRANT_SERVER_URL=https://internal-mirror.corp vagrant box add corp/base-box
# -> warning: Bearer token will be sent to internal-mirror.corp

# after
vagrant cloud auth logout
VAGRANT_SERVER_URL=https://internal-mirror.corp vagrant box add corp/base-box

Defensive patterns

Strategy: validation

Validate before calling

require "uri"
target = URI.parse(box_download_url)
server = URI.parse(ENV['VAGRANT_SERVER_URL'] || 'https://vagrantcloud.com')
raise "token would target custom host #{server.host}" if target.host == server.host && server.host != 'vagrantcloud.com'

Prevention

Set your own Authorization header when downloading through a proxy that must not see the Vagrant token — the middleware skips injection when one exists.
Unset VAGRANT_SERVER_URL for anonymous catalog downloads.
Rotate any token flagged by this warning and audit mirror logs for its use.

When it happens

Trigger: A stored cloud token plus VAGRANT_SERVER_URL pointing to a non-official host, combined with any action that downloads a box file through the downloader middleware (vagrant box add from the catalog, vagrant up first run, vagrant box update).

Common situations: Corporate mirrors fronting Vagrant Cloud; debugging with a local proxy server URL; environments where REPLACEMENT_HOSTS rewrite alt hostnames to TARGET_HOST but the operator's server_url is custom, producing token-bearing uploads to infrastructure the token was never issued for.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of hashicorp/vagrant@35f3160f4a (2026-08-21). Data as JSON: /api/errors/e5f6c858315f42f2. Report an issue: GitHub.