[VS-NfD] Remove the feed token from the query string, or allow feeds to be disabled #191

New Issue

fable-5 · 2026-07-30T01:43:29+02:00

fable-5 commented

2026-07-30 01:43:29 +02:00

Plan reference: 20-massnahmenplan.md -> Phase 2
ADR: n/a
Effort: M (2 AT)
Depends on: —

Context

Credentials in URLs land in proxy logs, browser history and referrer
headers. In a VS zone the proxy log is exactly the place where a long-lived
read credential must not appear.

Current state

apps/api/src/public/public.controller.ts:28,43 read the credential from
@Query('token'); apps/api/src/public/feed.service.ts:25 documents the
scheme (the query parameter authenticates the request as the token's
user).
Feed tokens are stored hashed (apps/api/src/public/feed-tokens.service.ts:73),
so the exposure is transport/logging, not storage.
There is no instance switch for feeds — instance-settings.service.ts
has api.enabled and mcp.enabled but no feed equivalent.

Acceptance criteria

Either the token moves out of the query string (header or path
segment with documented cache implications), or an instance
switch feeds.enabled (default off for the VS-NfD reference config)
makes the whole surface answer 404 — the plan allows either.
Whichever path is chosen, the other is documented as rejected with a
reason.
Tests: existing feed reader flow still works; with the switch off
every feed route answers 404; no code path logs the token.
Hardening guide (#227) lists the setting.

Out of scope

Replacing feeds with a different notification channel.

**Plan reference:** `20-massnahmenplan.md` -> Phase 2 **ADR:** n/a **Effort:** M (2 AT) **Depends on:** — ## Context Credentials in URLs land in proxy logs, browser history and referrer headers. In a VS zone the proxy log is exactly the place where a long-lived read credential must not appear. ## Current state - `apps/api/src/public/public.controller.ts:28,43` read the credential from `@Query('token')`; `apps/api/src/public/feed.service.ts:25` documents the scheme (the query parameter authenticates the request as the token's user). - Feed tokens are stored hashed (`apps/api/src/public/feed-tokens.service.ts:73`), so the exposure is transport/logging, not storage. - There is no instance switch for feeds — `instance-settings.service.ts` has `api.enabled` and `mcp.enabled` but no feed equivalent. ## Acceptance criteria - [ ] Either the token moves out of the query string (header or path segment with documented cache implications), **or** an instance switch `feeds.enabled` (default off for the VS-NfD reference config) makes the whole surface answer 404 — the plan allows either. - [ ] Whichever path is chosen, the other is documented as rejected with a reason. - [ ] Tests: existing feed reader flow still works; with the switch off every feed route answers 404; no code path logs the token. - [ ] Hardening guide (#227) lists the setting. ## Out of scope Replacing feeds with a different notification channel.

fable-5 added this to the M24 — VS-NfD: security quick wins milestone 2026-07-30 01:43:29 +02:00

fable-5 added the

effort:M

vs-nfd

area:auth

labels 2026-07-30 01:43:29 +02:00

fable-5 referenced this issue

2026-07-30 01:43:34 +02:00

[VS-NfD] Verify that no real `.env` is shipped and document the example as authoritative #198

fable-5 referenced this issue

2026-07-30 01:43:56 +02:00

[VS-NfD] Write the hardening guide with a "VS-NfD operation" reference configuration #227

fable-5 referenced this issue from a commit

2026-07-30 11:34:46 +02:00

#191: feeds.enabled instance switch, feed-token log masking

fable-5 referenced this issue

2026-07-30 11:35:02 +02:00

#191: feeds.enabled instance switch + feed-token log masking #242

fable-5 commented

2026-07-30 11:49:41 +02:00

Delivered by PR #242 (afef457), merged to main fast-forward (self-merge by fable-5 per Stefans standing approval this session). CI run 484 green. Closing.

Delivered by PR #242 (afef457), merged to main fast-forward (self-merge by fable-5 per Stefans standing approval this session). CI run 484 green. Closing.

fable-5 closed this issue

2026-07-30 11:49:42 +02:00

fable-5 referenced this issue

2026-07-30 11:59:31 +02:00

[VS-NfD] Define the deployment hardening-profile mode and the machine-readable VS-NfD configuration catalog #243

fable-5 referenced this issue

2026-07-30 21:42:13 +02:00

#198: CI fence -- no tracked .env or secret material, example is authoritative #253

Sign in to join this conversation.