aboutsummaryrefslogtreecommitdiffstats
path: root/lib/app.ts
Commit message (Collapse)AuthorAgeFilesLines
* logging: redact auth headers; set cookie flags on session token (S5)Adam Soltys2026-08-071-1/+12
| | | | | | | | | | | The request logger persisted full req.headers to the "req" log, including the Authorization bearer token and the token cookie — both non-expiring JWTs, so log-read access became account takeover. Redact the authorization and cookie headers. Also set httpOnly/secure/sameSite on the token cookie so it isn't readable by injected JS or sent over plaintext HTTP. (Revocation is already handled by the evicted set.) Co-Authored-By: Claude Opus 4.8 <[email protected]>
* logging: redact password fields from the request logAdam Soltys2026-07-101-1/+12
| | | | | | | | The preHandler request logger wrote the full request body, which included plaintext passwords on auth requests. Redact password/confirm fields before logging. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* adjust ln minfeeregtest-dataAdam Soltys2026-03-151-0/+1
|
* ip fallbackAdam Soltys2026-01-271-0/+5
|
* loggingAdam Soltys2026-01-261-0/+1
|
* loggingAdam Soltys2026-01-211-2/+0
|
* user agent rate limitingAdam Soltys2025-08-131-9/+43
|
* log queriesAdam Soltys2025-07-161-2/+4
|
* username checksAdam Soltys2025-06-161-2/+17
|
* track paymentsAdam Soltys2025-05-301-1/+4
|
* payload is bodyAdam Soltys2024-11-271-1/+1
|
* increase rate limitAdam Soltys2024-10-221-1/+1
|
* log usernamesAdam Soltys2024-10-141-0/+9
|
* request loggingAdam Soltys2024-10-131-4/+19
|
* use cached event for tagsonlyAdam Soltys2024-10-111-0/+1
|
* more ts housekeepingAdam Soltys2024-08-261-12/+19
|
* typescriptAdam Soltys2024-08-261-0/+66
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-21 07:31:35 +0000