Repository navigation
auth refresh prints token bytes to stdout instead of refreshing #19
Description
Severity
major
Summary
withings-export auth refresh is documented as "Force a token refresh and report status". In practice it just prints the first 20 chars of the access token to stdout and exits — it does not force a refresh, and it leaks token material into the user's scrollback / any captured logs.
Reproduce
$ withings-export auth refresh
Token valid: deb1cd0c847bec8edbe3...
Source (cmd/auth.go):
var refreshCmd = &cobra.Command{
Use: "refresh",
Short: "Force a token refresh and report status",
RunE: func(cmd *cobra.Command, args []string) error {
token, err := auth.GetToken()
if err != nil { return err }
fmt.Printf("Token valid: %s...\n", token[:min(20, len(token))])
return nil
},
}auth.GetToken() only refreshes if the cached token is within ~5 min of expiry; calling auth refresh on a token with hours of life left is a no-op masquerading as a refresh.
Expected
- Issue an explicit OAuth refresh against Withings (not a passive
GetToken()), regardless of expiry. - Print a status line to stdout that does NOT include any token bytes — e.g.
refreshed; new token expires 2026-04-25T19:00:00-04:00(matchingauth status's format). - Send progress to stderr if applicable; stdout stays one machine-friendly line.
Severity rationale
Major rather than blocker because the export commands themselves do refresh transparently when needed; this only affects users who explicitly run auth refresh to debug. The token-leak aspect bumps it above minor.
Metadata
Metadata
Assignees
Labels
No labels
Activity
DTTerastar commentedon Apr 25, 2026
Confirmed still reproduces against HEAD b580683:
/tmp/qa-bin/withings-export auth refresh->Token valid: <REDACTED 20-char token prefix>...and exit 0. Token bytes leaked to stdout, refresh not actually forced (token has hours of life left).DTTerastar commentedon Apr 26, 2026
@claude I think we should just remove refresh since the code should just do that automatically. It doesn't make sense as a cli command
claude commentedon Apr 26, 2026
Claude finished @DTTerastar's task in 1m 1s —— View job •
claude/issue-19-20260426-0004• Create PR ➔Removing
auth refreshsubcommandrefreshCmdfromcmd/auth.gostatusCmderror message and long description (removed references toauth refresh)Removed the
auth refreshsubcommand entirely fromcmd/auth.go. Changes:refreshCmdvariable (was leaking token bytes to stdout and not actually forcing a refresh)authCmd.AddCommand(refreshCmd)frominit()statusCmdlong description: replaced "Use 'auth refresh' (or any export subcommand) to actually refresh" → "Any export subcommand will refresh automatically when needed"statusCmderror message for an expired token:auth refresh→auth loginDTTerastar commentedon Apr 26, 2026
@claude Did you make a PR? Always PR in fixes! PR in whatever we need to make sure you do that in the future as well!
claude commentedon Apr 26, 2026
Claude finished @DTTerastar's task in 1m 47s —— View job •
claude/issue-19-20260426-0009• Create PR ➔Fixing issue #19 and creating PR
auth refreshsubcommand)The
gh pr createcommand wasn't approved, but everything is pushed. Please create the PR using the link below.Changes made:
refreshCmdfromcmd/auth.go— it leaked token bytes to stdout and didn't force a real refreshstatusCmdlong description and expired-token error to remove references toauth refresh→ now points toauth loginCLAUDE.mdso future Claude runs know to always open a PR after implementing changes•
claude/issue-19-20260426-0009