Skip to content

fix(websocket): omit credentials from URL logs - #263

Merged
argilzar merged 2 commits into
mainfrom
fix/websocket-credential-log-scrub
Nov 2, 2026
Merged

argilzar merged 2 commits into
mainfrom
fix/websocket-credential-log-scrub

Conversation

@olavurellefsen

@olavurellefsen olavurellefsen commented Sep 28, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Remove query strings, fragments, and URL user info from WebSocket endpoint logs on connect, close, error, and reconnect.
  • Use fixed diagnostics for setup errors and NotificationClient error events so untrusted error text cannot carry a credentialed URL into logs.
  • Keep WebSocket transport and authentication behavior unchanged; the SDK's legacy query fallback remains while server/client migration is coordinated.

Verification

  • Full local test suite: 248 passed.
  • Typecheck, lint, and diff check passed; GitHub build check passed.
  • Regression tests use synthetic credential strings and assert they do not appear in logs.

Compatibility

Tenant API subprotocol support is reviewed in service-tenant-api#116. Query-auth retirement and live log verification are later release gates.


Human review context

This PR is part of the Flowcore API-key remediation review brief. Please use the brief for the cross-repository review order and design questions. Code review is requested now; merge, deployment, monitor activation, and credential rotation remain separate gates.

@olavurellefsen
olavurellefsen force-pushed the fix/websocket-credential-log-scrub branch from 531ace6 to 377c602 Compare September 28, 2026 21:21
@olavurellefsen
olavurellefsen marked this pull request as ready for review September 29, 2026 05:19
@argilzar
argilzar merged commit b29d005 into main Nov 2, 2026
2 checks passed
@argilzar
argilzar deleted the fix/websocket-credential-log-scrub branch November 2, 2026 09:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants