- Shipped
- September 23, 2026 at 11:04 AM UTC
- Author
- Kamo
- Commit
- ed228ab
A grep for the shape of two known offenders (chat message text and chat-list previews going to console.log) turned up a much wider pattern across the session/auth surface and several content-carrying proxies: - /api/validate and /api/generate-otk — the OTK-issuing and OTK-redeeming routes — logged the raw 64-char OTK, the request URL with the OTK still on it as a query param (validate accepts the key that way), and 32-char prefixes of the *** session id. - /api/security/roles, roles/[id] and roles/rights logged 32-char *** prefixes on every call, and roles/route.ts and roles/[id]/route.ts also dumped every request header verbatim (masking only Authorization) — which put the full, untruncated Cookie and X-***-Token header in the log on every POST/PUT/DELETE. - /api/security/org/my-networks dumped every request header the same way. - /api/org/[...domain] logged the first 200 chars of the raw Cookie header, a 20-char value preview of every individual cookie, and a 50-char prefix of the kam_at access token. - /api/logout and /api/session/info logged *** prefixes; session/info also logged `redisKey`, which is `***<id>` — the full, un-truncated session id — right next to the "truncated" preview. - /api/user-info — polled every 5 minutes by every open tab — logged the member's email address and username alongside their id on every call, plus a 200-char slice of the raw session JSON blob from Redis. - Chat/ticket content: POST bodies and response payloads containing chat message text, chat-list previews, a member's full profile (PUT body and response), and support-ticket free text (creation body, rating comment) were logged whole. None of this was necessary for the diagnostics these logs exist for — ids, lengths, presence/absence and status codes say the same thing about what happened without saying what was said or handing out a replayable secret. Every log now keeps that shape; the actual response payloads (which do need to carry tokens like `sessionId`/`***Id`, `usernameAlias`, `memberEmail` etc. back to the legitimate caller) are untouched — this only touches what gets written to console.