Conversation
hjianbo
added a commit
that referenced
this pull request
Sep 17, 2026
`emqx_utils:redact/1` only masks values under sensitive keys, so two credentials reached the shared `send_packet` and `packet_received` debug logs in plaintext: the session token issued on `POST /mqtt/connection` and returned as the response payload, and credentials sent with the short query aliases (`t`, `p`). Wrap the session token in `emqx_secret' where it is produced and unwrap it in `serialize_pkt/2' for the wire, so it can never be logged. Redact the alias values in place, keeping the query keys the client actually sent.
Add an end-to-end assertion that a live session token never shows up in the packet debug logs, and pin the connection flow to drop `clientid_override` from the runtime clientinfo while still rendering the post-auth mountpoint.
hjianbo
force-pushed
the
fix/coap-session-token-and-clientid-override-r60
branch
from
September 17, 2026 13:17
392f615 to
7187023
Compare
hjianbo
marked this pull request as ready for review
September 18, 2026 02:53
`received_data`, `received_udp_proxy_data` and `send_data` dumped the raw encoded datagram, which can carry credentials (e.g. CoAP query parameters and the session token). Log only the byte size; the parsed packet is already logged by `packet_received` / `send_packet` with frame-level redaction.
`check_auth_state/2` logged a rejected request with `emqx_utils:redact/1`, which does not know the CoAP short query aliases (`t`, `p`). Share the alias-aware redaction from `emqx_coap_frame` and use it there instead. Also assert end-to-end that no debug log carries the session token, which covers the raw datagram dumps as well.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## dev-60 #19037 +/- ##
==========================================
+ Coverage 85.08% 85.52% +0.43%
==========================================
Files 1190 1174 -16
Lines 86646 88739 +2093
==========================================
+ Hits 73721 75890 +2169
+ Misses 12925 12849 -76 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: https://github.com/emqx/emqx-dev-team-tasks/issues/441
Release version: 6.0.4, 6.1.6, 6.2.4, 6.3.2, 7.0.0
Introduced in: pre-5.8
Summary
CoAP credentials could be written to the connection debug logs in plaintext.
emqx_utils:redact/1only masks values stored under sensitive keys, so it didnot cover two shapes used by the CoAP gateway:
2.01 Createdresponseto
POST /mqtt/connection. It is the valuecheck_token/2compares onsubsequent requests and it is also used on takeover, i.e. a live session
credential;
t,p), which are notrecognised as sensitive keys.
The token is now wrapped with
emqx_secretwhere it is produced(
emqx_coap_channel:process_connect/4) and unwrapped inemqx_coap_frame:serialize_pkt/2before it is put on the wire, so it can neverreach the shared
send_packet/packet_receiveddebug logs. Short-aliasvalues are redacted in place by
emqx_coap_frame:format/1; the query keys stayexactly as the client sent them, so the log is not misleading.
Channel#channel{token = ...}keeps the raw token, so the token comparison onheartbeat and takeover is unchanged.
Most relevant modules:
apps/emqx_gateway_coap/src/emqx_coap_channel.erl(wrap at the source)apps/emqx_gateway_coap/src/emqx_coap_frame.erl(unwrap for the wire, redact for logs)Tests:
emqx_coap_frame_tests: sensitive query keys, short aliases, wrapped-secretpayload redaction, and a serialize/parse round-trip proving the raw token is
still delivered on the wire.
emqx_coap_SUITE: an end-to-end check that a live session token never showsup in
send_packet/packet_receivedlogs, plus a regression test pinningthe runtime
clientinfoto dropclientid_override([6.3.1]CoAP Gateway retains clientid_override after PR #18842 warning path #18992, notreproducible on current code).
Design trade-offs
frame module free of protocol-semantic guesses, and automatically covers any
payload a credential is placed in later.
validate subsequent requests; only the logged and serialized representations
are handled.
emqx_coap_frame:format/1keeps the original query keys (only values areredacted) so a client that sent
?t=/?p=is not logged as if it had sent?token=/?password=.PR Checklist
changes/ee/(feat|perf|fix|breaking)-<PR-id>.en.mdfiles