mirror of https://github.com/OpenVidu/openvidu.git
38 lines
1.4 KiB
Markdown
38 lines
1.4 KiB
Markdown
# Design
|
|
|
|
## Context
|
|
|
|
- The codec copies a field of a protocol message only when the allow-list names it, with a rule per field. `redactURL`
|
|
rewrites a URL to scheme, host and path with the last segment replaced by `***`.
|
|
- `custom_base_url` has the rule `keep` in `RoomCompositeEgressRequest` and `TemplateSource`. The egress request
|
|
summary redacts it on its own, so only raw payloads hold the full value.
|
|
|
|
## Goals / Non-Goals
|
|
|
|
**Goals:**
|
|
- No stored payload holds the query string, userinfo or last path segment of a custom base URL.
|
|
|
|
**Non-Goals:**
|
|
- Rewriting stored events. The read side of an edition may redact them again.
|
|
|
|
## Decisions
|
|
|
|
### Same rule as the web URL
|
|
|
|
`custom_base_url` gets `redactURL`, the rule of `WebEgressRequest.url` and `WebSource.url`. A layout page under a
|
|
custom base URL is as likely as a web egress page to take a token in its query string or path.
|
|
|
|
Alternative rejected: `stripURLCredentials`, which keeps the path. A token in the last path segment would survive.
|
|
|
|
### Data model
|
|
|
|
- Collections: `events` (payloads of `EGRESS_*` events). No field, type, index or retention change; no schema-version
|
|
change.
|
|
- Migration from legacy events: the legacy migration encodes with the same codec, so migrated payloads are redacted too.
|
|
- Performance: none.
|
|
|
|
## Risks / Trade-offs
|
|
|
|
- [The redacted value no longer opens the layout] → The value is shown for reference only; the request summary was
|
|
already redacted.
|