Azure / Azure/LogicAppsUX

LA Consumption run history inputs not always sanitizing the Bearer token

Open
#9,085 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
111
Forks
109
Avg merge
1d 23h
Merged PRs (30d)
20

Description

### Severity

P2 - High (Major functionality broken)

### Describe the Bug with repro steps

Expected Behavior

When using Authorization Bearer token in the Header of HTTP action in LA consumption and looking into the Run history inputs the bearer token would need to be always sanitized.

Actual Behavior

For some HTTP Actions using the Bearer token in the Authorization Header the Token coming from previous action value is not sanitized and it is visible in the inputs of the action in a particular run.

### What type of Logic App Is this happening in?

Consumption (Portal)

### Are you experiencing a regression?

_No response_

### Which operating system are you using?

Windows

### Did you refer to the TSG before filing this issue? https://aka.ms/lauxtsg

Yes

### Workflow JSON

```json

```

### Screenshots or Videos

_No response_

### Environment

Browser: All

### Additional context

_No response_

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in the Consumption Portal by reproducing an HTTP action that uses an Authorization Bearer token supplied by a previous action, then inspect that action's run history inputs. Done means the token is consistently sanitized and never visible in the inputs for any affected HTTP action.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
frontend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.