Title: Are OAuth callback query parameters stored in Railway logs?

Hello Railway Community,

I am implementing an OAuth 2.0 authorization-code callback for an application hosted on Railway.

Example callback URL:

https://example.up.railway.app/api/oauth/callback

The OAuth provider redirects the user to this endpoint with short-lived parameters in the query string:

code

state

The application does not intentionally log the query string. It validates and consumes the parameters server-side and immediately redirects the user to a clean URL without query parameters.

Could you please clarify Railway’s logging behavior?

1. Does Railway’s edge proxy, HTTP proxy, or platform logging store the full request URL, including the query string?

2. Could the code and state values appear in:

• Deployment logs
• HTTP access logs
• Observability data
• Request traces
• Error reports
• Internal platform or support logs

1. Is there a way to disable query-string logging:

• For the entire Railway service
• For a specific callback path
• Through a Railway setting, configuration, or request header

1. If query-string logging cannot be disabled, what approach does Railway recommend for OAuth authorization-code callbacks?

2. Would using a custom domain instead of a default *.up.railway.app domain change the logging behavior?

3. Does Railway automatically redact common sensitive query parameters such as:

code

state

access_token

token

client_secret

1. What is the retention policy for proxy or access logs that may contain query strings, and who can access those logs?

2. Is the query string still recorded when the application immediately responds with:

HTTP 303 See Other

Cache-Control: no-store

Referrer-Policy: no-referrer

I would appreciate a link to official Railway documentation or confirmation of the current platform behavior.

No access token or client secret will be included in the callback URL. Only a short-lived authorization code and a one-time state parameter will be present.

Thank you.