From 85fa881e3c36c0bb1bdc6b08655a493eca40eb36 Mon Sep 17 00:00:00 2001 From: Danny Avila Date: Sun, 3 May 2026 21:27:41 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=90=20fix:=20Avoid=20Logging=20Passwor?= =?UTF-8?q?d=20On=20Login=20Validation=20Error=20(#12926)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Passport local strategy validation error logged the entire request body (including the password) into error logs. Replace it with the email only, matching the metadata shape used by sibling log calls in the same function. --- api/strategies/localStrategy.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api/strategies/localStrategy.js b/api/strategies/localStrategy.js index 5d725c0907..df0290a375 100644 --- a/api/strategies/localStrategy.js +++ b/api/strategies/localStrategy.js @@ -18,7 +18,7 @@ async function passportLogin(req, email, password, done) { try { const validationError = await validateLoginRequest(req); if (validationError) { - logError('Passport Local Strategy - Validation Error', { reqBody: req.body }); + logError('Passport Local Strategy - Validation Error', { email: req.body?.email }); logger.error(`[Login] [Login failed] [Username: ${email}] [Request-IP: ${req.ip}]`); return done(null, false, { message: validationError }); }