apache / apache/rocketmq

Avoid logging full gRPC responses in proxy ResponseWriter

Open
#10,724 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
22.6k
Forks
12k
Avg merge
3d 1h
Merged PRs (30d)
27

Description

## Problem

`ResponseWriter` logs the full gRPC response object before writing and again when the client has cancelled the request. Some proxy responses, especially receive-message responses, can carry message payload data. Logging the full protobuf response can therefore expose message bodies or other request data in proxy logs.

## Scope

Track 2 / Proxy Admin and gRPC diagnostics hardening. This is a logging-safety change only; it should preserve response write behavior.

## Expected behavior

- Do not log full gRPC response protobuf contents in `ResponseWriter`.
- Keep useful diagnostics such as response type and status/code when available.
- Add targeted tests to ensure receive-message payload bytes are not present in log summaries.

## Evidence

- `proxy/src/main/java/org/apache/rocketmq/proxy/grpc/v2/common/ResponseWriter.java` logs `response` directly in debug/warn paths.
- `ResponseWriter` is used by `ReceiveMessageResponseStreamWriter`, so receive responses can pass through this common logging path.

Contributor guide

Open the contributing guide

Research direction

Start with proxy/src/main/java/org/apache/rocketmq/proxy/grpc/v2/common/ResponseWriter.java and trace how ReceiveMessageResponseStreamWriter uses it. Review the debug and warning paths, then add targeted tests showing that receive-message payload bytes are absent while response type and status/code diagnostics remain available. Done means response writing is unchanged and full protobuf contents are no longer logged.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.