diff options
| author | Adam Soltys <[email protected]> | 2026-08-07 22:59:34 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-08-07 23:29:25 -0700 |
| commit | f9e8638b2443ebf2da2e11eb12d1a8d60bf7c9d6 (patch) | |
| tree | d1aa51e25386e364bcd918b098b61e2098479c59 /lib/utils.js.map | |
| parent | d513ab75131bfaa16b1f0820d0fb18ad9e7f6ab1 (diff) | |
| download | coinos-server-f9e8638b2443ebf2da2e11eb12d1a8d60bf7c9d6.tar.gz coinos-server-f9e8638b2443ebf2da2e11eb12d1a8d60bf7c9d6.zip | |
logging: redact auth headers; set cookie flags on session token (S5)
The request logger persisted full req.headers to the "req" log,
including the Authorization bearer token and the token cookie — both
non-expiring JWTs, so log-read access became account takeover. Redact
the authorization and cookie headers. Also set httpOnly/secure/sameSite
on the token cookie so it isn't readable by injected JS or sent over
plaintext HTTP. (Revocation is already handled by the evicted set.)
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Diffstat (limited to 'lib/utils.js.map')
0 files changed, 0 insertions, 0 deletions