Strip logging tokens with "[secret]"
Open
- Dominant language
- Jupyter Notebook
- Stars
- 13.3k
- Forks
- 5.8k
- Avg merge
- 6d 11h
- Merged PRs (30d)
- 7
Description
We noticed secret tokens get logged. This is problematic in enterprise systems.
Could we have something similar to what JupyterHub does:
https://github.com/jupyterhub/jupyterhub/blob/0561968fac88dd7ffae94c99dd49cab85ffcd6a8/jupyterhub/log.py#L58
I guess this should be implemented somewhere in:
https://github.com/jupyter/notebook/blob/master/notebook/notebookapp.py#L1251
Contributor guide
Research direction
Start by comparing JupyterHub's log.py implementation at the linked reference with notebook/notebookapp.py around line 1251. Trace how logging is configured there and define the change as preventing tokens marked [secret] from appearing in logged output; verify the behavior with the relevant logging tests if present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- jupyter-notebook, python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100