Security(L-01): auth diagnostics log identity and token-presence metadata (sub, scope, key names)

Summary

Authentication and Nebi diagnostics log identity and token-activity metadata at info level: usernames, auth-state key names, token-presence booleans, auth-state source, internal URLs, and decoded JWT claims including sub and scope. Raw tokens are not logged, which is good, but the metadata still exposes identity and credential activity to anyone who can read hub logs.

Severity: Low · CWE-532 (Sensitive Information in Logs)
Validation: Confirmed against HEAD f932d80 on 2026-07-14 (assessed at 69c84f7; unchanged since).

Evidence

• config/jupyterhub/03-nebi-envs.py:95-101 (and :78-84) logs the username, list(auth_state.keys()), has_refresh_token/has_access_token booleans, and the auth-state source.
• Internal URLs are logged at several points, for example 03-nebi-envs.py:133-136 (workspaces URL) and config/jupyterhub/01-spawner.py:471,510-514,564,598 (Keycloak/Nebi/session URLs, audience, client_id).
• JWT diagnostics log claims but not the token: 01-spawner.py:441-463 logs iss, aud, azp, exp, sub, scope, and for opaque tokens only the length. The sub (Keycloak user UUID) and full scope are logged at info level, which is more identity metadata than the assessment's list enumerated.

Impact

Log readers can reconstruct who authenticated, when tokens were present, and which realm subject and scopes were involved, without ever seeing a raw credential. This is a privacy and defense-in-depth concern rather than a direct credential leak.

Remediation

• Use pseudonymous request identifiers instead of raw usernames/subjects at info level.
• Remove token-presence logging at info level.
• Redact IdP error bodies.
• Enforce log access and retention policy.

_{Source: data-science-pack 0.1.0 security assessment (pinned commit 69c84f72df259ec755ed40bfc83f20158c550d55), finding L-01.}

Start by reviewing the logging sites in config/jupyterhub/03-nebi-envs.py and config/jupyterhub/01-spawner.py cited in the report, including the JWT diagnostic paths and IdP error handling. Trace what identity and token-activity metadata reaches info-level logs, then verify that the remediation removes or pseudonymizes sensitive metadata without logging raw credentials.