apache / apache/openwhisk-wskdeploy

Obfuscate secrets when logging information in verbose mode

Open
#824 0 comments 0 reactions 0 assignees View on GitHub
enhancement priority: medium
Dominant language
Go
Stars
75
Forks
73
PR merge metrics
No merged PRs in 30d

Description

When using wskdeploy in verbose mode (with the `-v` flag), it logs a lot of information, which is essential for debugging but also includes secret information.

This causes a security risk: developers may set the `-v` flag while debugging a CI script, which means secret information has now leaked into the log. They could remove the `-v` flag and change credentials once their script works but at some point, someone will forget. Conversely, developers debugging a script need to know that all important variables are set properly so something needs to be logged.

An approach I've seen somewhere else (I think it was Ansible but don't quote me on that) is to obfuscate secrets by only keeping the first and last characters, e.g. an auth key could be logged `626930...tEhDm5`: enough to know it's set correctly but not enough to leak the actual value.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.