appifyhub / monolith

The backbone backend service of Appify Hub
https://appifyhub.com
MIT License
1 stars 0 forks source link

Redact secrets in network responses #171

Open milosmns opened 6 months ago

milosmns commented 6 months ago

Provide a brief summary of the planned work

Some network responses have "secret" or "signature" properties revealed to the API user, others have the tokens shared in plain text… which may not be a good idea. We should redact the properties that could be too revealing.

Detailed overview

We need to:

  1. locate the models that expose secret properties
  2. redact those properties, or completely remove them from the network responses when possible

Hint/location:

1. Token value: com/appifyhub/monolith/features/auth/api/model/TokenDetailsResponse.kt:10 - value allowed when asked using the very same token
2. Push devices: com.appifyhub.monolith.features.user.api.model.PushDeviceResponse - potentially always allowed
3. Other models like `UserResponse` or similar

List the acceptance criteria

Include any additional notes (optional)

Related issues: