A private feed's key is written to the log when its fetch fails #238
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
When a feed's fetch fails, ipx logs the error, and reqwest's error text carries the whole address: "connecting: error sending request for url (https://www.patreon.com/rss/glasscannon?auth=...&show=...)". The feed_error event's message and msg field then hold a Patreon auth key in Loki, readable by anyone with Grafana. Seen 2026-10-15 06:07:50 UTC, feed androids-aliens-dead-suns-starfinder-1e, when five feeds timed out connecting at once. #225 took queries out of the traces' address fields but not out of error text.
The same path: download_error logs the enclosure's whole address in its url field and in its words (ipc.rs Event::DownloadError, "failed {url}: {msg}"), and a private feed's file addresses are signed too.
Shows it: query.py metric 'sum by (container) (count_over_time({container=
"iPX|ipx-directory|ipx-web"} |"(auth|token|key|secret)=[A-Za-z0-9]{6,}" [$range]))' 7d, 1 line. A fix strips the address from reqwest's errors (reqwest::Error::without_url, or feed::redact on the text) and redacts the download url field. The feed's last_error, shown to its own subscribers, may keep the detail.Fixed in
4e0b5ee, deployed (ipx and ipx-directory 1.1.1-dev): every event is redacted where it is emitted, so the log, the live stream to every page and a terminal get addresses without query or password, in address fields (download_error url, torrent_deferred url, feed_moved from/to) and in an error's words (feed::redact_text, which finds each http(s) address in text). The artwork proxy's warning and the directory's failed checks too. Tests: redact_drops_what_carries_a_credential, what_goes_out_names_no_private_feeds_key. The error kept on the feed, shown to its own subscribers, keeps the detail. The one line already in Loki from 2026-10-15 06:07 stays until Loki's retention drops it.