Redact auth headers in request logs (CurlLogger + ktor Logging) - #27
Open
HAll3LUJAH-origin wants to merge 2 commits into
Open
Redact auth headers in request logs (CurlLogger + ktor Logging)#27HAll3LUJAH-origin wants to merge 2 commits into
HAll3LUJAH-origin wants to merge 2 commits into
Conversation
added 2 commits
August 17, 2026 17:17
Ytmusic, SpotifyClient and SimpMusicLyrics install CurlLogger with no redactHeaders, so every logged request (debug builds / verbose logging) printed a full copy-paste-able curl command including the raw Cookie/Authorization header - the user's YouTube session cookie, Spotify sp_dc cookie and access token, and Apple Music bearer token. CurlLoggerConfig.redactHeaders already exists for exactly this but was unused by every caller. Wire it up: Cookie + Authorization everywhere, plus Client-Token for Spotify and X-HMAC for SimpMusicLyrics' signed write endpoints.
Ytmusic and SpotifyClient also install ktor's Logging plugin at level = LogLevel.ALL right next to CurlLogger, which logs headers through its own separate mechanism (sanitizeHeader) - unset, same leak as the CurlLogger call sites this branch already fixed. Wire up sanitizeHeader with the same header set.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ytmusic, SpotifyClient and SimpMusicLyrics install CurlLogger, and Ytmusic/SpotifyClient
additionally install ktor's built-in Logging plugin at level = LogLevel.ALL right next to it.
Neither had header redaction configured, so every logged request (debug builds / verbose
logging) printed the raw Cookie/Authorization header in full - the user's YouTube session
cookie, Spotify sp_dc cookie and access token, and Apple Music bearer token - through two
separate logging paths at once.
CurlLoggerConfig.redactHeaders already exists for exactly this but was unused by every caller,
and ktor's Logging plugin has the equivalent sanitizeHeader mechanism, also unused. Wired up
both with the same header set: Cookie + Authorization everywhere, plus Client-Token for Spotify
and X-HMAC for SimpMusicLyrics' signed write endpoints.