channels-stats reports published_messages and stored_messages for other instances

[blazczak]

I have multiple server instances defined in /etc/nginx/sites-available and enabled in /etc/nginx/sites-enabled, running on different ports for separation of concerns. Standard configurations, say:

instance A:

server { 
	listen 5601; 

	location /channels-stats {
		# activate channels statistics mode for this location
		push_stream_channels_statistics;

		# query string based channel path
		push_stream_channels_path                    $arg_id;
	}
	
	location /pub {
		# activate publisher (admin) mode for this location
		push_stream_publisher admin;

		# query string based channel path
		push_stream_channels_path                    $arg_id;

(...)

instance B:

server { 
	listen 5602; 

	location /channels-stats {
		# activate channels statistics mode for this location
		push_stream_channels_statistics;

		# query string based channel path
		push_stream_channels_path                    $arg_id;
	}
	
	location /pub {
		# activate publisher (admin) mode for this location
		push_stream_publisher admin;

		# query string based channel path
		push_stream_channels_path                    $arg_id;

(...)

After publishing messages to either server instance, when I send a request for channel stats to instance B curl -s -v --no-buffer 'http://XXX.XXX.XXX.XXX:5602/channels-stats', I receive numbers which are amalgamations of the amount of published_messages and stored_messages for both server instances (instance A + instance B). For example, if I publish 1000 messages to instance A and 500 to instance B, the numbers returned by the query against instance B are 1500, not 500. The names of the channels used to publish are different between server instances.

The numbers for published_messages and stored_messages should only be reported for the instance being queried, not for all instances on the nginx host, as this may leak information.

[wandenberg]

@blazczak sorry for the late response.
I see your point but so far this is how the stats of the module works.
They are "of the module" not of the server. It might be a feature for the future. (Happy to receive pull requests on this).
About the security and leaking information, I agree, but the stats feature was not intended to be publicly shared, the same goes for the events channel. I recommend you to move the stats location to an internal server, or protect it somehow.