Redact query values in transcript upstream URLs (security audit)

Transcript metadata persisted the full upstream URL including the client
query string; providers that accept credentials in query params would
have their keys stored in DO transcripts. redactedUpstreamURL keeps
origin + path + query key names and replaces every value with [redacted]
across the HTTP and WebSocket proxy meta; the actual upstream fetch URL
is unchanged. Tests assert the recorded meta keeps the key name, drops
the value, and the upstream request still receives the original query.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lawrencecchen

cloudflare/packages/worker/src/contract.ts

@@ -764,6 +764,14 @@ export const upstreamURLForRequest = (
   return output
 }
 
+export const redactedUpstreamURL = (url: URL | string): string => {
+  const input = new URL(url.toString())
+  const query = [...input.searchParams]
+    .map(([key]) => `${encodeURIComponent(key)}=[redacted]`)
+    .join("&")
+  return `${input.origin}${input.pathname}${query ? `?${query}` : ""}`
+}
+
 const upstreamPath = (
   requestPath: string,
   account: StoredAccountContract,

cloudflare/packages/worker/src/index.ts

@@ -14,6 +14,7 @@ import {
   normalizeAgentType,
   parseProxyRouteInput,
   providerForAccount,
+  redactedUpstreamURL,
   refreshFailureFromError,
   refreshOAuthCredentials,
   safeGoAccount,
@@ -2718,11 +2719,8 @@ const proxyUpstream = async (
       { status: 503 }
     )
   }
-  const upstreamURL = upstreamURLForRequest(
-    request.url,
-    account,
-    defaultUpstreamForAccount(env, account)
-  )
+  const defaultUpstream = defaultUpstreamForAccount(env, account)
+  const upstreamURL = upstreamURLForRequest(request.url, account, defaultUpstream)
   const headers = setUpstreamAuthHeaders(request.headers, account)
   const agentType = routeInput.agentType ?? "codex"
   const transcriptMetaInput = {
@@ -2736,7 +2734,7 @@ const proxyUpstream = async (
       account: account.id,
       method: request.method,
       path: new URL(request.url).pathname,
-      upstream: upstreamURL.toString(),
+      upstream: redactedUpstreamURL(upstreamURL),
       headers: redactedHeaders(stripSubrouterHeaders(request.headers)),
     },
   } satisfies TranscriptEventInput
@@ -2814,11 +2812,8 @@ const proxyUpstreamWebSocket = async (
       { status: 503 }
     )
   }
-  const upstreamURL = upstreamURLForRequest(
-    request.url,
-    account,
-    defaultUpstreamForAccount(env, account)
-  )
+  const defaultUpstream = defaultUpstreamForAccount(env, account)
+  const upstreamURL = upstreamURLForRequest(request.url, account, defaultUpstream)
   const headers = setUpstreamAuthHeaders(request.headers, account)
   headers.set("Upgrade", "websocket")
   await actor.recordTranscriptMeta({
@@ -2832,8 +2827,8 @@ const proxyUpstreamWebSocket = async (
       account: account.id,
       method: request.method,
       path: new URL(request.url).pathname,
-      upstream: defaultUpstreamForAccount(env, account),
-      upstream_url: upstreamURL.toString(),
+      upstream: redactedUpstreamURL(defaultUpstream),
+      upstream_url: redactedUpstreamURL(upstreamURL),
       headers: redactedHeaders(headers),
     },
   })

cloudflare/packages/worker/test/contract.test.ts

@@ -5,6 +5,7 @@ import {
   fetchProviderUsage,
   refreshOAuthCredentials,
   parseProxyRouteInput,
+  redactedUpstreamURL,
   safeGoAccount,
   scopedSessionKey,
   setUpstreamAuthHeaders,
@@ -138,6 +139,16 @@ describe("subrouter Durable Object contract", () => {
     ).toBe("https://api.openai.com/v1/responses")
   })
 
+  test("redacted upstream URLs keep parameter names without values", () => {
+    expect(
+      redactedUpstreamURL(
+        "https://api.openai.com/v1/chat/completions?key=sk-secret123&empty=&key=second#ignored"
+      )
+    ).toBe(
+      "https://api.openai.com/v1/chat/completions?key=[redacted]&empty=[redacted]&key=[redacted]"
+    )
+  })
+
   test("codex oauth refresh rotates access, refresh, and id tokens", async () => {
     const now = 1_780_000_000_000
     const expired = jwt(Math.floor((now - 1_000) / 1000))

cloudflare/packages/worker/test/proxy-streaming.test.ts

@@ -131,6 +131,52 @@ describe("HTTP proxy streaming transcripts", () => {
     })
   })
 
+  test("redacts upstream query values in transcript meta without changing the upstream request", async () => {
+    const events: TranscriptEvent[] = []
+    const waitUntilPromises: Promise<unknown>[] = []
+    let fetchedURL = ""
+    const actor = fakeActor({
+      async recordTranscriptMeta(input) {
+        events.push({ kind: "meta", input })
+        return { ok: true }
+      },
+      async recordTranscriptBody(input) {
+        events.push({ kind: "body", input })
+        return { ok: true }
+      },
+    })
+
+    setFetch(async (input) => {
+      fetchedURL = new Request(input).url
+      return new Response("ok", { status: 200 })
+    })
+    const response = await proxyUpstream(
+      proxyRequest({
+        body: "client-body",
+        sessionId: "redacted-query-session",
+        query: "?api_key=sk-secret123&debug=true",
+      }),
+      fakeEnv(),
+      actor,
+      routeInput("redacted-query-session"),
+      undefined,
+      (promise: Promise<unknown>) => waitUntilPromises.push(promise)
+    )
+
+    expect(response.status).toBe(200)
+    await response.text()
+    await Promise.all(waitUntilPromises)
+
+    expect(fetchedURL).toBe(
+      "https://upstream.example/backend-api/codex/responses?api_key=sk-secret123&debug=true"
+    )
+    expect(events[0]?.input.payload.upstream).toBe(
+      "https://upstream.example/backend-api/codex/responses?api_key=[redacted]&debug=[redacted]"
+    )
+    expect(JSON.stringify(events[0]?.input.payload)).toContain("api_key")
+    expect(JSON.stringify(events[0]?.input.payload)).not.toContain("sk-secret123")
+  })
+
   test("isolates deferred transcript RPC failures from the client response", async () => {
     const waitUntilPromises: Promise<unknown>[] = []
     const actor = fakeActor({
@@ -298,8 +344,9 @@ const proxyRequest = (input: {
   readonly method?: string
   readonly body?: string
   readonly sessionId: string
+  readonly query?: string
 }): Request =>
-  new Request("https://subrouter.example/v1/responses", {
+  new Request(`https://subrouter.example/v1/responses${input.query ?? ""}`, {
     method: input.method ?? "POST",
     headers: {
       Authorization: "Bearer tenant-key",