argoproj / argoproj/notifications-engine

Feat: redact debug logging

Open
#357 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
334
Forks
217
PR merge metrics
No merged PRs in 30d

Description

Hey,

when upping the log level to `debug` I noticed that the `Authorization`-header is logged.

It's probably coming from here, where the request is dumped: [pkg/util/http/logroundtripper.go#L21](https://github.com/argoproj/notifications-engine/blob/8cb0e74917d961212e2997eef1161f634426741a/pkg/util/http/logroundtripper.go#L21)

Example log line - 'TOKEN' is actually the secret as plain text:
```json
{"level":"debug","msg":"Sending request: POST /api/annotations HTTP/1.1\r\nHost: SOME-HOST\r\nAuthorization: Bearer TOKEN\r\nContent-Type: application/json SOME-MORE-STUFF","service":"SERVICE","time":"TIME"}
```

Would it be possible to redact the value or is there any reason to actually log that?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at pkg/util/http/logroundtripper.go#L21, where the outgoing request is dumped at debug level. Reproduce the example request and verify that the Authorization value is no longer exposed in the resulting log while the rest of the request remains appropriately visible.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.