@riocrypto/common-server 1.0.2938 → 1.0.2939

package/build/services/logger.js

@@ -143,20 +143,22 @@ class LoggerService {
                         headers[headerKey] = this.maskValue(String(headers[headerKey]));
                     }
                 });
-                // Mask cookies specifically
+                // Every cookie value is treated as a credential. An allowlist of names
+                // drifted out of date when admin-google-session was added, and the
+                // cookie name alone is enough to see which sessions a request carried.
+                // Split on the first "=" only, since base64 values may contain padding.
                 if (headers.cookie) {
-                    headers.cookie = headers.cookie
+                    headers.cookie = String(headers.cookie)
                         .split("; ")
                         .map((cookie) => {
-                        const [key, value] = cookie.split("=");
-                        if (key === "accessToken" ||
-                            key === "adminAccessToken" ||
-                            key === "refreshToken" ||
-                            key === "adminRefreshToken" ||
-                            key === "phoneVerifiedJWT") {
-                            return `${key}=${this.maskValue(value, true)}`;
-                        }
-                        return cookie;
+                        const separator = cookie.indexOf("=");
+                        if (separator === -1)
+                            return cookie;
+                        const key = cookie.slice(0, separator);
+                        const value = cookie.slice(separator + 1);
+                        if (value === "")
+                            return cookie;
+                        return `${key}=${this.maskValue(value, true)}`;
                     })
                         .join("; ");
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2938",
+  "version": "1.0.2939",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",