[boomzero]

Why

#72 stopped our own log lines from printing raw PHPSESSIDs, but Cloudflare still stores them. The userscript opens the notification WebSocket as /ws/notifications?SessionID=<PHPSESSID>, and Workers Logs' automatic invocation logs record every request's URL and headers (docs). A live wrangler tail after #73 deployed showed the raw session ID in that URL.

Moving the session into a header (e.g. Sec-WebSocket-Protocol) wouldn't help, because headers are logged too. It would also need a userscript release, and old versions would keep sending the URL anyway.

What

[observability.logs]
invocation_logs = false

• Workers Logs stops recording the automatic per-request entry (method, URL, headers, status).
• Our own Output.* / console.* lines are still stored. After fix: stop logging raw PHPSESSID values #72 they contain only a 16-character hash prefix of the session.
• Request analytics are unaffected. Analytics Engine (logdb) stores IP, endpoint, script version and username, with no session.
• This covers every client version immediately, with no userscript change.

To keep debugging, the worker now writes its own line for every request (RequestLogLine in index.ts):

{"method":"GET","path":"/ws/notifications","status":101,"durationMs":12,"colo":"HKG","country":"CN"}

It's a JSON object, so Workers Logs indexes each field, and you can filter by path, status and so on in the dashboard. A request that throws is logged with console.error, including the error, and then rethrown. The line never includes the query string or headers.

What we still lose: request headers (user agent etc.) and Cloudflare's per-invocation CPU time and outcome. CPU-limit and crash counts still show in the worker's Metrics tab.

Raw session IDs already in Workers Logs age out with Cloudflare's retention (3 days on Free, 7 on Paid).

Checks

npm test: 147 pass, including 3 new tests that check the log line never contains the query string. wrangler deploy --dry-run builds. I checked our own log lines: Fetch: prints only xmoj.tech page URLs (the session goes in a Cookie header, which isn't logged), and processCppString only sees public std code.

🤖 Generated with Claude Code

https://claude.ai/code/session_017dqWu3YgeVRGwBt5pXDq4A

Summary by Sourcery

Disable automatic Workers invocation logs and replace them with privacy-safe request logging to prevent raw session IDs from being stored.

Bug Fixes:

• Prevent raw session IDs from being captured in Cloudflare Workers invocation logs.

Enhancements:

• Add privacy-safe per-request logging with method, path, status, timing, location, and failure details while excluding query strings and headers.

Deployment:

• Disable Cloudflare Workers automatic invocation logs while retaining custom application logs and request analytics.

Tests:

• Add coverage ensuring request logs exclude query strings and correctly represent successful and failed requests.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates Wrangler configuration to disable automatic Workers invocation logs, preventing raw PHPSESSIDs in notification WebSocket URLs from being stored while preserving application logs and request analytics.

File-Level Changes

Change	Details	Files
Disable Cloudflare Workers automatic invocation logging to prevent raw session IDs from being persisted in request URLs and headers.	Add the observability logs configuration with invocation logging disabled. Retain application-generated console/output logs, which contain only hashed session identifiers after prior changes.	wrangler.toml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. If disabling invocation logs is the wrong call, request URLs and headers will be unavailable for troubleshooting and incident investigation during the affected period, and those records cannot be recreated after reverting. Reverting restores future invocation logging, while the change does not alter user data, access decisions, or application behavior.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>