security: redact session token from viewer access logs

[Sunil56224972]

Summary

The viewer server's log_message() override logs the full HTTP request line, including the query string. The bootstrap session token is passed as ?token=... in the initial page load URL (via authorized_url()), so it appears in plain text in log output.

Severity: Medium

If logs are persisted (e.g. --log-file, systemd journal, or redirected stdout), an attacker with read access to the log file can extract the token and hijack the viewer session — bypassing the session cookie authentication that protects:

• Live scan steering
• Report delivery
• Scan history browsing

Fix

Detect the per-process session token in the formatted log message and replace it with [REDACTED] before emitting the log line. This is a minimal, targeted change that:

• Preserves all other log output unchanged
• Only redacts the specific session token, not arbitrary content
• Has zero performance impact (simple string in check on debug-level log lines)

Files changed

• strix/viewer/server.py

Testing

• Verified that normal request logging works unchanged
• Requests containing the session token now show [REDACTED] in log output

[greptile-apps]

Greptile Summary

Prevents viewer session tokens from leaking through HTTP access logs.

• Formats each access-log message before emission.
• Replaces occurrences of the active bootstrap session token with [REDACTED].
• Preserves existing logging behavior for messages that do not contain the token.

Confidence Score: 5/5

The PR appears safe to merge, and the targeted redaction prevents the bootstrap token from being written to viewer access logs.

The URL-safe token appears unchanged in the formatted HTTP request line, and the new replacement removes every occurrence before the message reaches the logger while leaving unrelated log output unchanged.

Important Files Changed

Filename	Overview
strix/viewer/server.py	The access logger now redacts the exact per-process session token before emitting request details, with no identified functional regression.

_{Reviews (1): Last reviewed commit: "security: redact session token from view..." | Re-trigger Greptile}