Describe the bug

Until upgrading to version 1.28.0, I was refreshing the feeds with scheduled script calling curl with token as described here https://freshrss.github.io/FreshRSS/en/users/09_refreshing_feeds.html#for-form-authentication. The URL with all parameters I use:

http://freshrss/i/?c=feed&a=actualize&maxFeeds=10&ajax=1&user=def&token=${API_TOKEN}

After upgrading to 1.28.0 the feeds are not updated anymore. When debugging the problem, I found out the same URL is now returning 302 and redirecting to 404 page. I was checking release notes but haven't found any relation on first look.

I have tried to restore the backup and run version 1.27.1, the refreshing of feeds worked. After upgrading to 1.28.0, it returns 404. I have also tried to deploy fresh 1.27.1, verify it works, then upgrade to 1.28.0 with the same result.

Please let me know if any more information is needed or how can I help with the issue.

To Reproduce

Reproduced on Linux Fedora Silverblue 43 in container based deployment.

1. Create a local directory to store the data mkdir /tmp/freshrss-data

2. Start version 1.27.1: podman run --rm -ti -p 8080:80 -v /tmp/freshrss-data:/var/www/FreshRSS/data:z docker.io/freshrss/freshrss:1.27.1-alpine

3. Browse localhost:8080, go through the configuration wizard and add master authenticatio token to the user
   

4. Refresh the feeds using curl: curl "localhost:8080/i/?c=feed&a=actualize&u=alice&token=alice1234&ajax=1"

   

5. Stop the container (ctrl-c) and start the updated version: podman run --rm -ti -p 8080:80 -v /tmp/freshrss-data:/var/www/FreshRSS/data:z docker.io/freshrss/freshrss:1.28.0-alpine

6. Run the same refresh feeds command:

   

Expected behavior

The refreshing of the feeds via curl API call with user token should work the same after upgrade to 1.28.0.

FreshRSS version

1.28.0

System information

• Database version: SQLite
• PHP version: PHP 8.4.16
• Installation type: Docker (Kubernetes)
• Web server type: Apache
• Device: N/A
• OS: Ubuntu 22.04, Fedora Silverblue 43
• Browser: N/A

Additional context

The referred docs page shows a configuration of Authentication token that is not present in the settings anymore. Should this picture be replaced with a screenshot from the user Profile management page with Master authentication token?