From ae88b92151334154a90eba24d400ab8c47d9fbda Mon Sep 17 00:00:00 2001
From: mkelvers <mikkelelvers@outlook.com>
Date: Sat, 27 Jun 2026 20:53:55 +0200
Subject: [PATCH] fix: redact token query logs

---
 internal/server/observability.go | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/internal/server/observability.go b/internal/server/observability.go
index 9e3510a3..b3475ffe 100644
--- a/internal/server/observability.go
+++ b/internal/server/observability.go
@@ -3,6 +3,7 @@ package server
 import (
 	"mal/internal/observability"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -46,7 +47,7 @@ func RequestLogger() gin.HandlerFunc {
 			fields["route"] = route
 		}
 		if query != "" {
-			fields["query"] = query
+			fields["query"] = redactSensitiveQuery(query)
 		}
 		if size := c.Writer.Size(); size >= 0 {
 			fields["bytes"] = size
@@ -76,3 +77,17 @@ func requestLogLevel(status int) observability.LogLevel {
 	}
 	return observability.LogLevelInfo
 }
+
+func redactSensitiveQuery(query string) string {
+	parts := strings.Split(query, "&")
+	for i, part := range parts {
+		key := part
+		if before, _, ok := strings.Cut(part, "="); ok {
+			key = before
+		}
+		if strings.EqualFold(key, "token") {
+			parts[i] = key + "=REDACTED"
+		}
+	}
+	return strings.Join(parts, "&")
+}