fix: keep RDP creds out of tunnel URL/logs via single-use encrypted stash

server/internal/api/console.go

@@ -44,6 +44,13 @@ func consoleConnect(c *gin.Context) {
 		return
 	}
 
+	if body.Protocol == "rdp" && (body.RDPUsername != "" || body.RDPPassword != "") {
+		if err := services.StashConsoleRDPCreds(sess.SessionID, body.RDPUsername, body.RDPPassword); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+	}
+
 	services.LogEvent("console.opened", actorFromCtx(c), srv.ServerID, "",
 		"console session opened ("+body.Protocol+")")
 
@@ -83,10 +90,15 @@ func consoleTunnel(c *gin.Context) {
 		}
 	}
 
-	// RDP creds are single-use, passed via the connect step into the session
-	// document is avoided; instead they are re-supplied here as query params
-	// over the already-authenticated WS token. For ssh they are empty.
-	gp, err := services.BuildGuacParams(srv, sess.Protocol, privKey, c.Query("u"), c.Query("p"))
+	var rdpUser, rdpPass string
+	if sess.Protocol == "rdp" {
+		rdpUser, rdpPass, err = services.ConsumeConsoleRDPCreds(sessionID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "could not load credentials"})
+			return
+		}
+	}
+	gp, err := services.BuildGuacParams(srv, sess.Protocol, privKey, rdpUser, rdpPass)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return