diff options
| -rw-r--r-- | lib/app.ts | 13 | ||||
| -rw-r--r-- | routes/users.ts | 16 |
2 files changed, 26 insertions, 3 deletions
@@ -33,6 +33,17 @@ const redactBody = (body: any) => { return copy; }; +// Never persist session credentials to the request log. The Authorization +// bearer token and the token cookie are full account credentials (JWTs that +// don't expire) — logging them turns log-read access into account takeover. +const REDACT_HEADERS = ["authorization", "cookie"]; +const redactHeaders = (headers: any) => { + if (!headers || typeof headers !== "object") return headers; + const copy: any = { ...headers }; + for (const h of REDACT_HEADERS) if (h in copy) copy[h] = "[redacted]"; + return copy; +}; + // app.addHook("onRequest", async (req) => { // reqLogger.info({ url: req.raw.url, id: req.id }); // }); @@ -64,7 +75,7 @@ app.addHook("preHandler", async (req) => { method: req.method, url, ip, - headers: req.headers, + headers: redactHeaders(req.headers), query: req.query, body: redactBody(req.body), user: (req.user as any)?.username, diff --git a/routes/users.ts b/routes/users.ts index eafcd74a..ed2d3861 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -454,7 +454,13 @@ export default { const payload = { id: user.id }; const token = jwt.sign(payload, config.jwt); - res.cookie("token", token, { expires: new Date(Date.now() + 432000000) }); + res.cookie("token", token, { + expires: new Date(Date.now() + 432000000), + path: "/", + httpOnly: true, + secure: true, + sameSite: "lax", + }); user = pick(user, whitelist); res.send({ user, token }); } catch (e) { @@ -514,7 +520,13 @@ export default { const payload = { id: user.id }; const token = jwt.sign(payload, config.jwt); - res.cookie("token", token, { expires: new Date(Date.now() + 432000000) }); + res.cookie("token", token, { + expires: new Date(Date.now() + 432000000), + path: "/", + httpOnly: true, + secure: true, + sameSite: "lax", + }); user = pick(user, whitelist); res.send({ user, token }); } catch (e) { |