Hey, would you be able to share the network request that happens when you click on "Backup manually"?

You can find it in your browser's Developer Tools -> Network and filter the URLs by q=volumeInstanceBackupCreate

Here is "copy as cURL", I get a 200 back from this request. The only part I removed before pasting is the header Cookie for potential security issues.

curl 'https://backboard.railway.com/graphql/internal?q=volumeInstanceBackupCreate' \

-X 'POST' \

-H 'Content-Type: application/json' \

-H 'Accept: /' \

-H 'Sec-Fetch-Site: same-site' \

-H 'Accept-Language: en-US,en;q=0.9' \

-H 'Accept-Encoding: gzip, deflate, br' \

-H 'Sec-Fetch-Mode: cors' \

-H 'Origin: https://railway.com' \

-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15' \

-H 'Referer: https://railway.com/' \

-H 'Content-Length: 287' \

-H 'Sec-Fetch-Dest: empty' \

-H 'Cookie:<redacted>' \

-H 'Priority: u=3, i' \

--data-binary '{"query":"mutation volumeInstanceBackupCreate($volumeInstanceId: String!) {\n volumeInstanceBackupCreate(volumeInstanceId: $volumeInstanceId) {\n workflowId\n }\n}","variables":{"volumeInstanceId":"97591412-db5e-4f0f-93a7-d1d8df0c020c"},"operationName":"volumeInstanceBackupCreate"}'

Could you copy-paste the response you see in your network tab? (Sorry for the unclear instructions; the response is what we actually need)

No problem, here is the response.

Response metadata:

:status: 200

Access-Control-Allow-Credentials: true

Access-Control-Allow-Origin: https://railway.com

Cache-Control: no-store

cf-cache-status: DYNAMIC

cf-ray: 8fecdb224d79e761-DEN

Content-Encoding: br

Content-Type: application/json; charset=utf-8

Date: Wed, 08 Jan 2025 14:25:17 GMT

Server: cloudflare

Vary: Origin, Accept-Encoding

Via: 1.1 google

Response Data:

{

"data": {

"volumeInstanceBackupCreate": {

"workflowId": "createVolumeInstanceBackup/97591412-db5e-4f0f-93a7-d1d8df0c020c"

}

}

}

Can you confirm whether this volume UUID string should be protected? Can an attacker with this UUID do anything if they do not have access to my Railway account?

Ah gotcha. So you're limited to 10 backups and it seems you've exceeded that limit. You can try deleting older backups to free up your slots.

Out of curiousity, do you not see this in the UI? "Maximum backup usage reached for you plan. Delete older backups to free up space" (feels like we have a UI bug here that doesn't pop that message up correctly)

And yes, the UUID is safe to share.

Ahh I had no idea. No I don’t think that limit is shown on the UI. If you added something like “max backups reached” and disabled the backup button then it would be clear.

Best regards.

Yup we'll definitely fix this. Thanks for raising it up!

Going to resolve this thread, feel free to re-open if you have further questions on this

ninja edit: This has been fixed! You should see the errors now.