AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES=false does not mask instance token
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 65/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- typescript
Research direction
Locate the GET /instance/fetchInstances handler and the AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES flag handling; first trace how apikey and hash are currently removed. Reproduce with the flag false and verify that token is omitted or masked for every returned instance, while the existing authentication fields remain protected.
Written by the indexing model from the issue text.
Description
Summary: With AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES=false, GET /instance/fetchInstances still returns the instance token field. Only apikey/hash are masked.
Environment: Evolution API v2.3.7, env AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES=false.
Endpoint: GET /instance/fetchInstances
Expected behavior: When the flag is false, sensitive authentication material (apikey, hash, token) should be omitted or masked from the response.
Actual behavior: The response still contains the full token (a 36-char UUID) for each instance. Verified live on v2.3.7 with the flag set to false: { hasToken: true, tokenLen: 36, hasApiToken: false, hasHash: false, hasApikey: false } — hash and apikey are suppressed, but token is not.
Repro steps:
- Start the API with
AUTHENTICATION_EXPOSE_IN_FETCH_INSTANCES=false. GET /instance/fetchInstanceswith the globalapikeyheader.- Inspect the JSON: each instance still includes a
tokenfield with the full instance token.
Impact: Instance tokens (which grant session-level access) are exposed even when the operator explicitly disables exposure in fetchInstances.
- Dominant language
- TypeScript
- Stars
- 9.6k
- Forks
- 7.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from evolution-foundation/evolution-api
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
evolution-foundation/evolution-api#2700 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
All issues in evolution-foundation/evolution-api
Similar issues
-
VerificationGate: ATTRIBUTION quote guard never matches a normal quotation (\b around the quote) Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
danielmiessler/LifeOS#2234 ·
-
T: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
Mend: dependency security vulnerability untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 70/100