goauthentik / goauthentik/authentik

Outpost leaks sensitive token information by default

Open
#24,274 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

### Describe the bug

Using Outpost with traditional "Proxy" mode in Authentik (meaning, *not the Forward Auth* mode) has a critical undesired side effect that is logging all GET parameters including the token, user details and such.

This seems to be happening at the latest version 2026.5.3 as well.

Sample of redacted logs
```
{"auth_via": "session"
"domain_url": "authentik.public-outpost-domain.com"
"event": "/if/flow/default-provider-authorization-explicit-consent/?client_id=ABC&redirect_uri=https%3A%2F%2Fauthentik.public-outpost-domain.com%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=openid+profile+entitlements+email+ak-proxy-headers+ak_proxy+offline_access&state=ey[REDATED]"
"host": "authentik.public-outpost-domain.com"
"level": "info"
"logger": "authentik.asgi"
"method": "GET"
"pid": 798692
"remote": "1.2.3.4"
"request_id": "0ab82c08d3254f82b92c447c5a83094f"
"runtime": 51
"schema_name": "public"
"scheme": "https"
"status": 200
"timestamp": "2026-07-21T20:42:25.693034"
"user": "user@domain.com"
"user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0"}
```

Please do observe that I have configured the OUTPOST with `log_level: warning` and it still shows up altogether.

### How to reproduce

1. Enable OUTPOST provider
2. Select "PROXY" mode (and not any "Forward auth"
3. Look for `authentik-server` logs

### Expected behavior

Have state and sensitive information redacted

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Kubernetes

### Version

2026.5.3

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Research direction

Start by tracing requests from the Outpost in Proxy mode to the authentik-server logs, focusing on the logged GET parameters and the configured warning log level. Reproduce the flow described in the issue and verify that state, tokens, and other sensitive information are redacted from the resulting logs.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
authentication, observability, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.