Severity
major
Summary
withings-export auth refresh is documented as "Force a token refresh and report status". In practice it just prints the first 20 chars of the access token to stdout and exits — it does not force a refresh, and it leaks token material into the user's scrollback / any captured logs.
Reproduce
$ withings-export auth refresh
Token valid: deb1cd0c847bec8edbe3...
Source (cmd/auth.go):
var refreshCmd = &cobra.Command{
Use: "refresh",
Short: "Force a token refresh and report status",
RunE: func(cmd *cobra.Command, args []string) error {
token, err := auth.GetToken()
if err != nil { return err }
fmt.Printf("Token valid: %s...\n", token[:min(20, len(token))])
return nil
},
}auth.GetToken() only refreshes if the cached token is within ~5 min of expiry; calling auth refresh on a token with hours of life left is a no-op masquerading as a refresh.
Expected
- Issue an explicit OAuth refresh against Withings (not a passive
GetToken()), regardless of expiry.
- Print a status line to stdout that does NOT include any token bytes — e.g.
refreshed; new token expires 2026-04-25T19:00:00-04:00 (matching auth status's format).
- Send progress to stderr if applicable; stdout stays one machine-friendly line.
Severity rationale
Major rather than blocker because the export commands themselves do refresh transparently when needed; this only affects users who explicitly run auth refresh to debug. The token-leak aspect bumps it above minor.
Severity
major
Summary
withings-export auth refreshis documented as "Force a token refresh and report status". In practice it just prints the first 20 chars of the access token to stdout and exits — it does not force a refresh, and it leaks token material into the user's scrollback / any captured logs.Reproduce
Source (
cmd/auth.go):auth.GetToken()only refreshes if the cached token is within ~5 min of expiry; callingauth refreshon a token with hours of life left is a no-op masquerading as a refresh.Expected
GetToken()), regardless of expiry.refreshed; new token expires 2026-04-25T19:00:00-04:00(matchingauth status's format).Severity rationale
Major rather than blocker because the export commands themselves do refresh transparently when needed; this only affects users who explicitly run
auth refreshto debug. The token-leak aspect bumps it above minor.