fix(web): stop dumping the config and request headers to the journal - #479
fix(web): stop dumping the config and request headers to the journal#479ChuckBuilds wants to merge 1 commit into
Conversation
save_main_config logged its entire POST body and the full request headers at ERROR on every save. The body is the configuration itself, and the headers carry the session cookie, so a routine settings change wrote both to the journal -- at a level that guarantees they survive any sane log filter. The lines are leftover debug output: they say "DEBUG:" in the message while calling logging.error, and they went through the root logger rather than the module logger, bypassing the level configured for this blueprint. Replaced with a debug-level line recording the shape of the request, which is the part with diagnostic value. The local `import logging` went with them; it shadowed a module-level import that was already there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01STMbQE4YctTacQXfbYqKuW
|
Warning Review limit reached
Next review available in: 13 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
|
Superseded by #485, which combines the seven api_v3.py PRs so they do not conflict with each other. Every change from this PR is verified present on that branch; the branch here is untouched if you want to compare. |
save_main_configlogged its whole POST body and full request headers at ERROR, on every save:The body is the configuration itself; the headers carry the session cookie. A routine settings change wrote both to the journal, at a level that survives any sane log filter.
They are leftover debug output — they say
DEBUG:in the message while callinglogging.error, and they use the root logger rather than the module logger, so the level configured for this blueprint never applied.Replaced with a
logger.debugline recording the request's shape, which is the part with diagnostic value. The localimport loggingwent too: it shadowed a module-level import already present at line 13.260 web tests pass.
Found while investigating #478, which fixes the credential erasure in the same function.