Private feeds' tokens are kept in traces #225
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The fetch span (crates/feed/src/lib.rs, #[tracing::instrument(fields(url = %feed_url))]) records the feed's whole address, query included, so a private feed's credential goes to Tempo with every scan: Patreon's ?auth=..., and any feed whose address carries a token or key. The download span (crates/ipx/src/main.rs, fields(url = url)) does the same for enclosure addresses, which for private feeds are signed too.
Anyone who can read Tempo (Grafana) can read them, and they are kept as long as Tempo keeps traces. Not new: present in scans at 02:30 and 08:33 UTC on 2026-10-13, before 1.0.1-dev's deploy.
Shows it: query.py traces '{ span.url =~ ".(auth|token|key)=." }' 24h (100 traces), e.g. ee0dafa4c26f95016ad048282bfe18a7.
Found by the prod check on 2026-10-13. A fix records the address without its query (and without user:password), or with the values of its parameters masked.
Fixed in
382f51a, deployed (ipx and ipx-directory 1.0.1-dev): feed::redact drops the query, fragment and user:password from the address the fetch and download spans record. Checked on a forced fetch of a Glass Cannon show: trace 83b28ad9cdbf92ee596f3e66b9896028 has url https://www.patreon.com/rss/glasscannon, no auth. A token carried in a path would still be recorded. Traces from before the deploy keep the key until Tempo ages them out.