goauthentik / goauthentik/authentik
Outpost leaks sensitive token information by default
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 659
Description
### Describe the bug
Using Outpost with traditional "Proxy" mode in Authentik (meaning, *not the Forward Auth* mode) has a critical undesired side effect that is logging all GET parameters including the token, user details and such.
This seems to be happening at the latest version 2026.5.3 as well.
Sample of redacted logs
```
{"auth_via": "session"
"domain_url": "authentik.public-outpost-domain.com"
"event": "/if/flow/default-provider-authorization-explicit-consent/?client_id=ABC&redirect_uri=https%3A%2F%2Fauthentik.public-outpost-domain.com%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=openid+profile+entitlements+email+ak-proxy-headers+ak_proxy+offline_access&state=ey[REDATED]"
"host": "authentik.public-outpost-domain.com"
"level": "info"
"logger": "authentik.asgi"
"method": "GET"
"pid": 798692
"remote": "1.2.3.4"
"request_id": "0ab82c08d3254f82b92c447c5a83094f"
"runtime": 51
"schema_name": "public"
"scheme": "https"
"status": 200
"timestamp": "2026-07-21T20:42:25.693034"
"user": "user@domain.com"
"user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0"}
```
Please do observe that I have configured the OUTPOST with `log_level: warning` and it still shows up altogether.
### How to reproduce
1. Enable OUTPOST provider
2. Select "PROXY" mode (and not any "Forward auth"
3. Look for `authentik-server` logs
### Expected behavior
Have state and sensitive information redacted
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Kubernetes
### Version
2026.5.3
### Relevant log output
```shell
```
Contributor guide
Research direction
Start by tracing requests from the Outpost in Proxy mode to the authentik-server logs, focusing on the logged GET parameters and the configured warning log level. Reproduce the flow described in the issue and verify that state, tokens, and other sensitive information are redacted from the resulting logs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- authentication, observability, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100