argoproj / argoproj/notifications-engine
Feat: redact debug logging
- Dominant language
- Go
- Stars
- 334
- Forks
- 217
- PR merge metrics
- No merged PRs in 30d
Description
Hey,
when upping the log level to `debug` I noticed that the `Authorization`-header is logged.
It's probably coming from here, where the request is dumped: [pkg/util/http/logroundtripper.go#L21](https://github.com/argoproj/notifications-engine/blob/8cb0e74917d961212e2997eef1161f634426741a/pkg/util/http/logroundtripper.go#L21)
Example log line - 'TOKEN' is actually the secret as plain text:
```json
{"level":"debug","msg":"Sending request: POST /api/annotations HTTP/1.1\r\nHost: SOME-HOST\r\nAuthorization: Bearer TOKEN\r\nContent-Type: application/json SOME-MORE-STUFF","service":"SERVICE","time":"TIME"}
```
Would it be possible to redact the value or is there any reason to actually log that?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at pkg/util/http/logroundtripper.go#L21, where the outgoing request is dumped at debug level. Reproduce the example request and verify that the Authorization value is no longer exposed in the resulting log while the rest of the request remains appropriately visible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100