- Shipped
- October 18, 2026 at 6:42 AM UTC
- Author
- Kamo
- Commit
- f767b81
/api/login logged the form it forwards to SecurityService verbatim (`username=…&password=<clear text>&***Payload=…`) and the redirect URL SecurityService answers with, which carries the unspent one-time key (`/validate?otk=…`). Both are credentials. The form is now logged by field name and the redirect by host only. No answer, cookie or redirect changes. Found while moving the session-cookie block for IoT SP09; pinned by tests/***-cookie.test.mjs (next commit), which fails on the old route with the password in the captured log.