fix(auth): stop logging account_id on registration - #10
Merged
Conversation
`account_id` is the KDF salt passed to derive_keys, not an opaque identifier. Logging it at INFO put it in the container logs and anywhere those are shipped or retained, where it hands a reader offline precompute against that user's password — the one value the deep-link rules say must never be exposed. `user_id` stays on both lines and identifies the registration; the two columns are joinable in the database if an operator needs the mapping. The value still appears where the protocol requires it: the challenge and login responses return it to the account's own client, which needs the salt to derive its keys.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Flagged while reviewing #9 and noted there as out of scope; this is the follow-up.
src/routes/auth.rsloggedaccount_idat INFO on both registration branches:Despite the name it is the KDF salt passed to
derive_keys, not an opaque identifier. VoltiusApp/voltius#144 states the rule for deep links — never put it in a URL, because exposing it enables offline precompute against that user's password. A log line is the same exposure with a longer tail: it lands in the container logs and in anything that ships or retains them, readable by anyone with access to either.Removed from both branches.
user_idremains on each line and identifies the registration; an operator who needs the mapping can join the two columns in the database, so nothing operational is lost.Deliberately unchanged:
/v1/auth/challengeand the login response still returnaccount_idto the account's own client. That is the protocol — the client cannot derive its keys without the salt.296 tests pass;
cargo clippy --all-targets -- -D warningsis clean.