From 0df2741251a088e510728d0f55971d7cbde4b3f1 Mon Sep 17 00:00:00 2001
From: Ethan O'Brien <ethan.a.obrien@gmail.com>
Date: Tue, 11 Aug 2026 18:17:53 -0500
Subject: [PATCH] Change log

---
 src/router/multi_live/ws.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/router/multi_live/ws.rs b/src/router/multi_live/ws.rs
index 62d8291..44872ff 100644
--- a/src/router/multi_live/ws.rs
+++ b/src/router/multi_live/ws.rs
@@ -216,7 +216,15 @@ async fn authenticate(
     };
 
     let Some(uid) = resolve_user(&user_id, &token) else {
-        println!("multi_live/ws: rejecting uid {}: bad session", user_id);
+        // Never print the token itself (it is the login credential); empty-vs-unknown is
+        // the diagnostic that matters: empty means the client sent no credential at all
+        // (the pre-fix Android builds sent UserSaveData.m_uuid, which device builds never
+        // populate), unknown means a credential the tokens table has no row for.
+        println!(
+            "multi_live/ws: rejecting uid {}: bad session ({})",
+            user_id,
+            if token.is_empty() { "empty token" } else { "unknown token" }
+        );
         close(tx, CLOSE_UNAUTHENTICATED);
         return None;
     };