From 32ed315c13474d6e1bc4a07f72f67eb8372368fd Mon Sep 17 00:00:00 2001 From: HAll3LUJAH Date: Mon, 17 Aug 2026 17:17:26 +0500 Subject: [PATCH 1/2] Redact auth headers in CurlLogger request logs Ytmusic, SpotifyClient and SimpMusicLyrics install CurlLogger with no redactHeaders, so every logged request (debug builds / verbose logging) printed a full copy-paste-able curl command including the raw Cookie/Authorization header - the user's YouTube session cookie, Spotify sp_dc cookie and access token, and Apple Music bearer token. CurlLoggerConfig.redactHeaders already exists for exactly this but was unused by every caller. Wire it up: Cookie + Authorization everywhere, plus Client-Token for Spotify and X-HMAC for SimpMusicLyrics' signed write endpoints. --- .../kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt | 1 + .../commonMain/kotlin/org/simpmusic/lyrics/SimpMusicLyrics.kt | 1 + .../src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt | 1 + 3 files changed, 3 insertions(+) diff --git a/service/kotlinYtmusicScraper/src/commonMain/kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt b/service/kotlinYtmusicScraper/src/commonMain/kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt index 8be71934..afe084e4 100644 --- a/service/kotlinYtmusicScraper/src/commonMain/kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt +++ b/service/kotlinYtmusicScraper/src/commonMain/kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt @@ -157,6 +157,7 @@ class Ytmusic { expectSuccess = true install(CurlLogger) { logger = { Logger.d(TAG, it) } + redactHeaders = setOf("Cookie", "Authorization") } install(HttpRedirect) { checkHttpMethod = false diff --git a/service/lyricsService/src/commonMain/kotlin/org/simpmusic/lyrics/SimpMusicLyrics.kt b/service/lyricsService/src/commonMain/kotlin/org/simpmusic/lyrics/SimpMusicLyrics.kt index 4dc39ba0..25f5544d 100644 --- a/service/lyricsService/src/commonMain/kotlin/org/simpmusic/lyrics/SimpMusicLyrics.kt +++ b/service/lyricsService/src/commonMain/kotlin/org/simpmusic/lyrics/SimpMusicLyrics.kt @@ -49,6 +49,7 @@ class SimpMusicLyrics { install(HttpCache) install(CurlLogger) { logger = { Logger.d("SimpMusicLyrics", it) } + redactHeaders = setOf("Authorization", "X-HMAC", "Cookie") } install(HttpSend) { maxSendCount = 100 diff --git a/service/spotify/src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt b/service/spotify/src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt index 6d0d94ac..43c32bee 100644 --- a/service/spotify/src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt +++ b/service/spotify/src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt @@ -62,6 +62,7 @@ class SpotifyClient { } install(CurlLogger) { logger = { Logger.DEFAULT.log(it) } + redactHeaders = setOf("Cookie", "Authorization", "Client-Token") } install(HttpSend) { maxSendCount = 100 From f24f350d6d640baa7e8335ad9b2e25923f444961 Mon Sep 17 00:00:00 2001 From: HAll3LUJAH Date: Mon, 17 Aug 2026 17:20:24 +0500 Subject: [PATCH 2/2] Redact same headers in ktor's built-in Logging plugin Ytmusic and SpotifyClient also install ktor's Logging plugin at level = LogLevel.ALL right next to CurlLogger, which logs headers through its own separate mechanism (sanitizeHeader) - unset, same leak as the CurlLogger call sites this branch already fixed. Wire up sanitizeHeader with the same header set. --- .../kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt | 1 + .../commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/service/kotlinYtmusicScraper/src/commonMain/kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt b/service/kotlinYtmusicScraper/src/commonMain/kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt index afe084e4..90655e22 100644 --- a/service/kotlinYtmusicScraper/src/commonMain/kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt +++ b/service/kotlinYtmusicScraper/src/commonMain/kotlin/com/maxrave/kotlinytmusicscraper/Ytmusic.kt @@ -166,6 +166,7 @@ class Ytmusic { install(Logging) { logger = io.ktor.client.plugins.logging.Logger.DEFAULT level = LogLevel.ALL + sanitizeHeader { header -> header.equals("Cookie", ignoreCase = true) || header.equals("Authorization", ignoreCase = true) } } install(ContentNegotiation) { protobuf() diff --git a/service/spotify/src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt b/service/spotify/src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt index 43c32bee..e8e786e2 100644 --- a/service/spotify/src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt +++ b/service/spotify/src/commonMain/kotlin/com/maxrave/spotify/SpotifyClient.kt @@ -59,6 +59,11 @@ class SpotifyClient { install(Logging) { logger = Logger.DEFAULT level = LogLevel.ALL + sanitizeHeader { header -> + header.equals("Cookie", ignoreCase = true) || + header.equals("Authorization", ignoreCase = true) || + header.equals("Client-Token", ignoreCase = true) + } } install(CurlLogger) { logger = { Logger.DEFAULT.log(it) }