---
title: "ADR-0012: Stable denial reasons without new secret leaks"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0012@main"
source: "Adr/ADR-0012-ErrorsAndObservability.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# ADR-0012: Stable denial reasons without new secret leaks {#adr-0012}

-   *Status:* Historical proposal (original status: Proposed)
-   *Date:* 2026-10-08
-   *Original decision makers:*

    Project architecture/security owners; approval
    still pending in the original proposal.

-   *Requirements:* HG-031, HG-032, HG-033, HG-034, HG-035
-   *Original supersession:* None; a new decision for the proposed product.

> [!NOTE]
> This is the full English translation of the historical proposal dated
> 2026-10-08, originally Proposed. Its pending approval is historical and
> creates no additional alpha approval gate. Current
> [Security model and limits](https://docs.typo3.org/permalink/netresearch/nr-http-guard:security@main), [Development and tests](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development@main), [Verification report](https://docs.typo3.org/permalink/netresearch/nr-http-guard:verification-report@main) and
> [Requirements and security invariants](https://docs.typo3.org/permalink/netresearch/nr-http-guard:development-requirements@main) describe the operative scope and evidence.
>
> The later single-package decision is recorded in [ADR-0015: One installable extension](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-0015@main).

## Context {#adr-0012-context}

A security guard needs diagnostics, but logs can themselves expose
credentials. URLs may carry query tokens; requests contain bodies, cookies and
authentication headers. A statistics callback run after sending is also not
preventive connection control.

Sources: `[S04, S08, S15]`.

## Decision {#adr-0012-decision}

The library supplies fixed reason codes with a typed exception surface.
Synchronous and promise-based calls do not differ in policy decision. Policy
errors are not disguised as ordinary network timeouts. PSR-18 recognizes them
as client errors; the included request may still be a sensitive object.

Telemetry contains mode, decision, profile/policy identifier, address class,
scheme/port, resolver source and correlation. No bodies, header values, URL
paths, queries or complete exceptions. Host display is configured separately;
pseudonymous host values use an operator HMAC key, not a publicly guessable
hash presented as anonymization. Metric labels retain low cardinality.

Logger errors must never turn deny into allow. Rate limits reduce log floods,
not denial counters. Diagnostic commands send no probe HTTP requests.
`on_stats` may report a deviation afterwards, but never replaces
plan/pin protection.

## Rejected alternatives {#adr-0012-rejected-alternatives}

-   **Log complete requests for debugging:** creates an exfiltration path.
-   **Label every denial an attack:** confuses typos, DNS problems and abuse.
-   **Always deny HTTP on logging failure:** unnecessary global availability
    coupling; Vault audit may separately be stricter.

## Consequences {#adr-0012-consequences}

Operations can identify causes without exposing secrets. Deeper debugging
requires targeted synthetic reproduction. Other project middleware remains
responsible for its own logs; the guard cannot retrospectively sanitize its
telemetry.

## Evidence and acceptance in the original proposal {#adr-0012-verification-and-acceptance}

`T062, T063, T064, T065, T067, T068`. Details and expected results
are in [Original verification specification](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/06-verification.md). These tests were specified, not
executed as part of the original documentation delivery.

## Reasons to reconsider {#adr-0012-reassessment-trigger}

Before inclusion, new telemetry fields are checked for secret content and
cardinality. A complete request dump is not permitted as a debugging
convenience.

## Related documents {#adr-0012-related-documents}

[Original ADR](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/adr/ADR-0012-fehler-und-beobachtbarkeit.md), [Original product requirements](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/01-product-requirements.md), [Original security model](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/02-security-model.md),
[Original architecture](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/03-architecture.md) and [Original source catalogue](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/specification/specs/08-evidence-and-sources.md) (`S01-S23`),
plus the [ADR index](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-index@main). [Original sources](https://docs.typo3.org/permalink/netresearch/nr-http-guard:adr-original-sources@main) explains
the immutable source index.