don't log csrf in URL
Massimo Melina committed
Jun 29, 2023 at 12:11 UTC
ad6cc9b905b96a664c7e17724eb7f30fc5c34ab5
1 file changed
+3
-2
src/log.ts
+3
-2
@@ -101,7 +101,8 @@ export const logMw: Koa.Middleware = async (ctx, next) => {
101
const date = a[2]+'/'+a[1]+'/'+a[3]+':'+a[4]+' '+a[5]?.slice(3)
102
const user = getCurrentUsername(ctx)
103
const length = ctx.state.length ?? ctx.length
104
- events.emit(logger.name, Object.assign(_.pick(ctx, ['ip', 'method','status']), { length, user, ts: now, uri: ctx.originalUrl }))
104
+ const uri = ctx.originalUrl?.replace(/&?csrf=[^&]+/, '') // temporary workaround. To avoid csrf in url we need to stop using EventSource.
105
+ events.emit(logger.name, Object.assign(_.pick(ctx, ['ip', 'method','status']), { length, user, ts: now, uri }))
106
debounce(() => // once in a while we check if the file is still good (not deleted, etc), or we'll reopen it
107
stat(logger.path).catch(() => logger.reopen())) // async = smoother but we may lose some entries
108
stream!.write(util.format( format,
@@ -109,7 +110,7 @@ export const logMw: Koa.Middleware = async (ctx, next) => {
110
user || '-',
111
date,
112
ctx.method,
112
- ctx.originalUrl,
113
+ uri,
114
ctx.req.httpVersion,
115
ctx.status,
116
length?.toString() ?? '-',