fix(log): redact OAuth code and state query params in the access log

[PierreBrisorgueil]

Summary

• What changed: added code and state to DEFAULT_SENSITIVE_QUERY_KEYS in lib/helpers/redactUrl.js, unioned with config.log.sensitiveQueryKeys extensions per refactor(log): source sensitive redaction lists from config as pure extensions #3961. Updated the development.config.js comment listing the built-in defaults to match.
• Why: OAuth callback requests (GET /api/auth/:strategy/callback?code=...&state=...) were logging the one-time authorization code and state cleartext in the morgan access log. Same single-use-secret-in-URL leak class already closed for inviteToken/reset/verify-email tokens (fix(log): redact single-use path tokens in the morgan access log #3955/refactor(log): source sensitive redaction lists from config as pure extensions #3961) — access logs persist and reach log shippers far longer than the code's short TTL.
• Related issues: Closes 🔒 Redact OAuth code and state in the access log #3967

Scope

• Module(s) impacted: lib/helpers/redactUrl.js (shared log redaction helper), config/defaults/development.config.js (comment only)
• Cross-module impact: none — pure additive extension to the existing sensitive-query-key list, no schema/API change
• Risk level: low

Validation

• npm run lint
• npm test
• Manual checks done (if applicable)

Guardrails check

• No secrets or credentials introduced (.env*, secrets/**, keys, tokens)
• No risky rename/move of core stack paths
• Changes remain merge-friendly for downstream projects
• Tests added or updated when behavior changed

Notes for reviewers

• Security considerations: this closes a confirmed cleartext leak of OAuth code/state in the access log. Fix is additive-only (built-in defaults list), consistent with the config-sourcing contract landed in refactor(log): source sensitive redaction lists from config as pure extensions #3961 (union of defaults + config extensions, never a replace).
• Mergeability considerations: none — isolated to the redaction helper and its tests.
• Tests: added red-green callback-redaction unit tests (bare code/state params, mixed with other query params, and an explicit SENSITIVE_QUERY_KEYS assertion), plus updated the 4 existing config-sourcing tests that assert the exact default array. Full suite: 2187 tests green, 100% coverage on lib/helpers/redactUrl.js.

https://claude.ai/code/session_01WfNC8bt1TgL4AsiYgCEGup

Summary by CodeRabbit

• Bug Fixes
  • Sensitive OAuth callback parameters (code and state) are now automatically redacted from logged URLs.
  • URL paths and other query parameters remain unchanged when sensitive values are removed.
• Documentation
  • Updated configuration notes to reflect the default redaction behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: cfcaa5af-3a11-4e30-ac26-f8c76037670f

📥 Commits

Reviewing files that changed from the base of the PR and between ac772a4 and 4240020.

📒 Files selected for processing (3)

• config/defaults/development.config.js
• lib/helpers/redactUrl.js
• lib/helpers/tests/redactUrl.unit.tests.js

---

Walkthrough

The URL redaction defaults now include OAuth code and state query parameters alongside inviteToken. Unit tests and configuration comments are updated to reflect the expanded defaults.

Changes

OAuth URL redaction

Layer / File(s)	Summary
Expand default sensitive query keys lib/helpers/redactUrl.js, lib/helpers/tests/redactUrl.unit.tests.js, config/defaults/development.config.js	code and state are redacted by default, with coverage for mixed query strings, configuration fallbacks, malformed values, and updated documentation comments.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• 🔒 Redact OAuth code and state in the access log #3967 — Directly addresses default redaction for OAuth code and state query parameters.

Possibly related PRs

• pierreb-devkit/Node#3955 — Updates URL redaction behavior and tests for token-like secrets in URL paths.
• pierreb-devkit/Node#3961 — Overlaps in SENSITIVE_QUERY_KEYS handling and OAuth callback redaction tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: redacting OAuth code and state query params in access logs.
Description check	✅ Passed	The description covers summary, scope, validation, guardrails, and reviewer notes, with only an optional section omitted.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/3967-redact-oauth-code-state

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.06%. Comparing base (ac772a4) to head (4240020).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3972   +/-   ##
=======================================
  Coverage   93.06%   93.06%           
=======================================
  Files         170      170           
  Lines        5595     5595           
  Branches     1802     1803    +1     
=======================================
  Hits         5207     5207           
  Misses        313      313           
  Partials       75       75           

Flag	Coverage Δ
integration	61.26% <100.00%> (ø)
unit	74.85% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ac772a4...4240020. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.