notifications-engine icon indicating copy to clipboard operation
notifications-engine copied to clipboard

Feat: redact debug logging

Open jan-mrm opened this issue 10 months ago • 0 comments

Hey,

when upping the log level to debug I noticed that the Authorization-header is logged.

It's probably coming from here, where the request is dumped: pkg/util/http/logroundtripper.go#L21

Example log line - 'TOKEN' is actually the secret as plain text:

{"level":"debug","msg":"Sending request: POST /api/annotations HTTP/1.1\r\nHost: SOME-HOST\r\nAuthorization: Bearer TOKEN\r\nContent-Type: application/json SOME-MORE-STUFF","service":"SERVICE","time":"TIME"}

Would it be possible to redact the value or is there any reason to actually log that?

jan-mrm avatar Feb 21 '25 07:02 jan-mrm