Signed /video/original/stream?token=… URLs were landing in the journal (actix Logger) and in the tracing root span's http.target (journal ERROR lines + OTel export). The token grants access to one, possibly sensitive, file for 6 h.
App
+ .wrap(from_fn(redact_original_stream_token)) # outermost: runs first
.wrap(TracingLogger) # http.target now sees token=redacted
.wrap(cors)
.wrap(Logger) # request line now sees token=redacted
redact_original_stream_token
+ if path == /video/original/stream and query has token=
+ extensions.insert(OriginalStreamToken(token))
+ uri = /video/original/stream?token=redacted
stream_original_video
- web::Query<{token}>
+ request.extensions().get::<OriginalStreamToken>() # absent → 401 (fails closed)
redact_middleware_strips_token_from_uri handler sees uri "/video/original/stream?token=redacted", token in extensions
take_token_param_redacts_only_the_token other params kept; "tokens=" untouched
stream_original_video_fails_closed_without_middleware → 401
original_video_url_streams_with_range_and_no_auth_header still 206 through the middleware
Full suite 1,545 passed; clippy + fmt clean.
Merge Danger
Door: two-way
Blast Radius: small
Only /video/original/stream is touched. If the middleware were ever dropped from main.rs, original playback 401s (mobile falls back to HLS) rather than leaking. Tokens already in the journal from tonight's testing stay valid until ~04:30 (6 h expiry).
## Summary
Signed `/video/original/stream?token=…` URLs were landing in the journal (actix `Logger`) and in the tracing root span's `http.target` (journal ERROR lines + OTel export). The token grants access to one, possibly sensitive, file for 6 h.
```diff
App
+ .wrap(from_fn(redact_original_stream_token)) # outermost: runs first
.wrap(TracingLogger) # http.target now sees token=redacted
.wrap(cors)
.wrap(Logger) # request line now sees token=redacted
redact_original_stream_token
+ if path == /video/original/stream and query has token=
+ extensions.insert(OriginalStreamToken(token))
+ uri = /video/original/stream?token=redacted
stream_original_video
- web::Query<{token}>
+ request.extensions().get::<OriginalStreamToken>() # absent → 401 (fails closed)
```
## Evidence
- **Before:** prod journal, 22:23:40:
`"GET /video/original/stream?token=eyJ0eXAiOiJKV1Qi…ILC4uD8e9SEtvRYKkoUFjdIcN1Zc7dE8XnPfRrbEspA HTTP/1.1" 206 …`
**After:**
```text
redact_middleware_strips_token_from_uri handler sees uri "/video/original/stream?token=redacted", token in extensions
take_token_param_redacts_only_the_token other params kept; "tokens=" untouched
stream_original_video_fails_closed_without_middleware → 401
original_video_url_streams_with_range_and_no_auth_header still 206 through the middleware
```
Full suite 1,545 passed; clippy + fmt clean.
## Merge Danger
**Door:** two-way
**Blast Radius:** small
Only `/video/original/stream` is touched. If the middleware were ever dropped from `main.rs`, original playback 401s (mobile falls back to HLS) rather than leaking. Tokens already in the journal from tonight's testing stay valid until ~04:30 (6 h expiry).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The access log and the tracing root span's http.target both recorded the
full /video/original/stream?token=… URL, i.e. a credential for a
possibly sensitive file, in the journal and OTel exports. An outermost
middleware now moves the token into request extensions and rewrites the
URI to token=redacted before either logger sees it; the handler reads
the token from extensions and fails closed (401) without the middleware.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cameron
merged commit 1d2848db05 into master2026-10-14 02:35:24 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Signed
/video/original/stream?token=…URLs were landing in the journal (actixLogger) and in the tracing root span'shttp.target(journal ERROR lines + OTel export). The token grants access to one, possibly sensitive, file for 6 h.Evidence
"GET /video/original/stream?token=eyJ0eXAiOiJKV1Qi…ILC4uD8e9SEtvRYKkoUFjdIcN1Zc7dE8XnPfRrbEspA HTTP/1.1" 206 …After:
Merge Danger
Door: two-way
Blast Radius: small
Only
/video/original/streamis touched. If the middleware were ever dropped frommain.rs, original playback 401s (mobile falls back to HLS) rather than leaking. Tokens already in the journal from tonight's testing stay valid until ~04:30 (6 h expiry).🤖 Generated with Claude Code