cloud_command.middleware.authentication.different_target

Error message

cloud_command.middleware.authentication.different_target

What it means

Security-conscious warning from the cloud auth middleware (add_authentication.rb) injected into box-add/download action chains. When a token exists and the configured Vagrant server URL (Vagrant.server_url) points at a host other than the known Vagrant Cloud target (TARGET_HOST), the middleware is about to append that access token to box URLs for the custom host, so it warns that your credential will be sent to the custom server, shows both hostnames, sleeps CUSTOM_HOST_NOTIFY_WAIT, and flags self.class.custom_host_notified! so it warns only once.

Source

Thrown at plugins/commands/cloud/auth/middleware/add_authentication.rb:67

                u.to_s
              else
                url
              end
            rescue URI::Error
              url
            end
          end

          server_uri = URI.parse(Vagrant.server_url.to_s)

          if token && !server_uri.host.to_s.empty?
            env[:box_urls].map! do |url|
              begin
                u = URI.parse(url)

                if u.host == server_uri.host
                  if server_uri.host != TARGET_HOST && !self.class.custom_host_notified?
                    env[:ui].warn(I18n.t("cloud_command.middleware.authentication.different_target",
                      custom_host: server_uri.host, known_host: TARGET_HOST) + "\n")
                    sleep CUSTOM_HOST_NOTIFY_WAIT
                    self.class.custom_host_notified!
                  end

                  q = CGI.parse(u.query || "")

                  current = q["access_token"]
                  if current && current.empty?
                    q["access_token"] = token
                  end

                  u.query = URI.encode_www_form(q)
                end

                u.to_s
              rescue URI::Error
                url

View on GitHub (pinned to 35f3160f4a)

Solutions

If the custom server should NOT receive your token, unset it before the operation: `vagrant cloud auth logout` (removes the stored token) or unset VAGRANT_SERVER_URL.
Verify which host is in play: `echo $VAGRANT_SERVER_URL` and compare with the known_host printed in the warning.
If the custom server legitimately needs the token (private mirror), accept the warning; it fires once per process thanks to custom_host_notified!.
For shared/CI machines, scope tokens per server and revoke any token that may have reached an untrusted mirror.

Example fix

# before
export VAGRANT_SERVER_URL=https://mirror.internal.example
vagrant up   # token gets injected into mirror box URLs -> warning

# after (no token leakage to mirror)
export VAGRANT_SERVER_URL=https://mirror.internal.example
vagrant cloud auth logout 2>/dev/null || true
vagrant up

Defensive patterns

Strategy: validation

Validate before calling

require "uri"
server = URI.parse(ENV['VAGRANT_SERVER_URL'] || 'https://vagrantcloud.com')
token_exists = File.exist?(File.join(ENV['VAGRANT_HOME'] || File.join(Dir.home, '.vagrant.d'), 'data', 'cloud-token'))
if token_exists && server.host != 'vagrantcloud.com'
  warn "token would be sent to custom host #{server.host}; unset VAGRANT_SERVER_URL or log out"
end

Prevention

Never set VAGRANT_SERVER_URL and store a production token on the same machine unless the mirror is trusted.
Use scoped, revocable tokens per environment.
Watch for this warning in CI logs as a leak detector; rotate the token if it appears unexpectedly.

When it happens

Trigger: VAGRANT_SERVER_URL (or a config setting server_url) is set to a custom/mirror host while a Vagrant Cloud token is stored (via `vagrant cloud auth login`), and you then run a box operation (vagrant box add / vagrant up needing download) whose box_urls include that custom host.

Common situations: Air-gapped or mirrored environments using an internal Vagrant Cloud clone; developers switching between Vagrant Cloud and a company catalog and forgetting they hold a production token; CI images that pre-login and also set VAGRANT_SERVER_URL, unknowingly shipping the token to the mirror.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of hashicorp/vagrant@35f3160f4a (2026-08-21). Data as JSON: /api/errors/c43114a69756f8f0. Report an issue: GitHub.