mirror of
https://github.com/clusterio/clusterio.git
synced 2026-11-12 15:04:52 +09:00
BastiaanandClaude Opus 5.5
fe1391903a
The controller HTTP access log and the express error log wrote the full request headers at the http level, which both default log transports keep. Clients send their access token in X-Access-Token or Authorization: Bearer, so user and host tokens ended up in plain text in controller and cluster logs, and the cluster log can be read back over the API with core.log.query. Mask the authorization, x-access-token, cookie and proxy-authorization headers before logging. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>