Page MenuHomePhabricator

Use "%P" to protect session key hashes in SessionEngine queries from DarkConsole
ClosedPublic

Authored by epriestley on Nov 15 2018, 1:31 PM.
Tags
None
Referenced Files
F19504964: D19812.diff
Fri, Jan 9, 8:14 AM
F19502635: D19812.diff
Thu, Jan 8, 5:52 PM
F19483428: D19812.diff
Thu, Jan 8, 1:16 AM
F19159969: D19812.id47314.diff
Mon, Dec 15, 3:45 AM
F19122239: D19812.id47314.diff
Dec 9 2025, 11:20 PM
F19092839: D19812.id.diff
Dec 3 2025, 6:51 PM
F19081686: D19812.diff
Dec 2 2025, 7:57 AM
F18895684: D19812.id47314.diff
Nov 7 2025, 3:20 PM
Subscribers
None

Details

Summary

Ref T6960. Ref T13217. Ref T13216. Depends on D19811. Use the recently-introduced "%P" conversion ("Password/Secret") to load sessions in SessionEngine.

This secret isn't critical to protect (it's the hash of the actual secret and not useful to attackers on its own) but it shows up on every page in DarkConsole and is an obvious case where %P is a more appropriate conversion.

Test Plan

Note "*****" in the middle of the output here, instead of a session key hash:

Screen Shot 2018-11-15 at 5.28.57 AM.png (333×1 px, 102 KB)

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable