grpc / grpc/grpc-node

Debug logs expose sensitive information

Open
#1,515 1 comment 0 reactions 0 assignees View on GitHub
package: @grpc/grpc-js
Dominant language
TypeScript
Stars
4.8k
Forks
716
Avg merge
2d 3h
Merged PRs (30d)
10

Description

### Problem description

Enabling debug logs might be necessary to, well, debug some issues. While debugging, I noticed that `subchannel` trace logs expose e.g. an authorization header of requests:

```
2020-07-27T06:58:46.331Z | subchannel | Starting stream with headers
x-goog-api-client: gax/2.6.3 gapic/4.1.1 gl-node/14.4.0 grpc/1.1.3 gccl/4.1.1
google-cloud-resource-prefix: [REDACTED]
x-goog-request-params: [REDACTED]
authorization: Bearer [REDACTED]
```

I wanted to bring this to your attention as it might be wise to change this behavior, especially that sometimes we ask others to provide these logs and some might not notice.

### Reproduction steps

Just enable trace logs for subchannels and make an authenticated request.

### Environment
- OS name, version and architecture: all
- Node version: all
- Node installation method: all
- If applicable, compiler version: not applicable
- Package name and version: 1.1.3

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.