Skip to content

Stop logging faucet request secrets#56

Merged
Woody4618 merged 1 commit intosolana-developers:mainfrom
afurm:af/redact-request-secrets
Apr 30, 2026
Merged

Stop logging faucet request secrets#56
Woody4618 merged 1 commit intosolana-developers:mainfrom
afurm:af/redact-request-secrets

Conversation

@afurm
Copy link
Copy Markdown
Contributor

@afurm afurm commented Apr 27, 2026

Summary

  • Removes logging of raw request headers from /api/request.
  • Stops logging the bearer bypass token value.
  • Keeps a minimal non-secret request log that records the client IP and whether an auth bypass token was present.

Why

The faucet request handler previously logged the full headers() object and the raw Authorization bearer token used for bypass checks. In production, that could expose session cookies, authorization headers, or privileged bypass tokens through application logs.

Validation

  • npm run lint
  • npm run build

Both passed. The repo still reports an existing React hook dependency warning in components/AirdropForm.tsx, unrelated to this change.

@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 27, 2026

@afurm is attempting to deploy a commit to the Solana Foundation Team on Vercel.

A member of the Team first needs to authorize it.

@Woody4618 Woody4618 merged commit 66eb7ec into solana-developers:main Apr 30, 2026
1 check failed
@Woody4618
Copy link
Copy Markdown
Collaborator

That makes sense, thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants