diff options
| -rw-r--r-- | CLAUDE.md | 18 |
1 files changed, 18 insertions, 0 deletions
@@ -556,6 +556,24 @@ by default and correct; it is simply waiting for a publisher who marks breaks. ## Things a future session should know +- **Apache does not log query strings for listen.terst.org, deliberately** (2026-11-05). Both + vhost files define a `listen_noquery` LogFormat -- `%m %U %H` where `combined` uses `%r` -- so + the request line reaches the log without its query. The reason is that `/audio/` URLs carry the + server's token as a query parameter, because a URL handed to a downloader has to work as it + stands, and `combined` therefore wrote the token in plaintext into a file logrotate keeps + fourteen copies of. 335 lines across fifteen files; all redacted in place at the time, and the + token is worth rotating on any suspicion since it sat there for months. + + **Do not set these back to `combined`.** If a line's query is ever genuinely needed for + debugging, log it from the Go server, which can redact what it prints. + + The real fix is for the audio URL to stop carrying a token at all, which needs + `EpisodeDownloader` to send `Authorization: Bearer` for skip-server hosts — and only those, or + the token goes to every podcast CDN. The app change has to be installed *before* the server + stops emitting the query token, or downloads 401 in the gap. The transcript URL already made + this move: it never needed one, because the phone was sending the header anyway. + + - **Nothing the listener reads is written for a machine, and the build enforces it** (`PlainLanguageTest`, added 2026-11-05). A red banner on Peter's phone read "Playback failed: ERROR_CODE_IO_BAD_HTTP_STATUS"; his words were "arcane and sketchy" and both halves were fair. |