Don't log urlencoded access_tokens

1 files changed, 2 insertions, 2 deletions

diff --git a/synapse/app/homeserver.py b/synapse/app/homeserver.py

index 58a4c812f6..bafac884a3 100755
--- a/synapse/app/homeserver.py
+++ b/synapse/app/homeserver.py
@@ -496,8 +496,8 @@ class SynapseRequest(Request):
 
     def get_redacted_uri(self):
         return re.sub(
-            r'(\?.*access_token=)[^&]*(.*)$',
-            r'\1<redacted>\2',
+            r'(\?.*accesss(_|%5[Ff])token=)[^&]*(.*)$',
+            r'\1<redacted>\3',
             self.uri
         )