This repository was archived by the owner on Apr 26, 2024. It is now read-only.
Repository navigation
This repository was archived by the owner on Apr 26, 2024. It is now read-only.
/_matrix/client/unstable/add_threepid/email/submit_token logs "token" and "client_secret" #6157
Description
Description
Are these things that should be logged (at the INFO level) or should they show up as <redacted>?
Oct 03 04:11:23 ubuntu matrix-synapse[20095]: 2019-10-03 04:11:23,310 - synapse.access.http.8008 - 233 - INFO - GET-5508 - 8008 - Received request: GET /_matrix/client/unstable/add_threepid/email/submit_token?token=a...&client_secret=b...&sid=c...
Version information
- Version: 1.4.0rc2
Activity
anoadragon453 commentedon Oct 3, 2019
Thank you for reporting this, we've redacted
client_secretin #6158 (for v1.4.0) for now and plan to fix this properly with a spec change in the near future.aaronraimist commentedon Dec 5, 2019
Should this stay open? If something needs to change with the spec do you want to file an issue on matrix-doc?