배포

[chungjeongsu]

No description provided.

[gemini-code-assist]

Code Review

This pull request transitions the extraction of travelItineraryId from query parameters to the token payload within SecondaryTokenAuthenticator.js, while also introducing extensive logging for WebSocket lifecycle events in TravelDocWebSocketServer.js. Feedback was provided regarding a potential sensitive data exposure in the URL sanitization logic, where a fallback is needed to ensure tokens are redacted even if URL parsing fails.

[gemini-code-assist]

The catch block in sanitizeRequestUrl returns the original req.url if parsing fails. If the URL contains a sensitive secondaryToken and the parser throws an error (e.g., due to a malformed host header or an invalid URL structure), the unredacted token will be logged. It is safer to return a generic string or perform a basic string replacement as a fallback to prevent sensitive data exposure in logs.

Suggested change

	} catch {
	return req.url ?? "/";
	}
	} catch {
	return (req.url ?? "/").replace(/secondaryToken=[^&]*/g, "secondaryToken=[redacted]");
	}