vault icon indicating copy to clipboard operation
vault copied to clipboard

VAULT-23121: Audit - Empty fields are HMAC and appear in audit logs

Open peteski22 opened this issue 1 year ago • 3 comments

We've had reports where customers see a different output structure in their audit logs depending on whether they are using log_raw option or not.

When raw output is enabled, empty fields which have been marked to be omitted from JSON output are honored, however when HMAC is applied, the empty fields first have HMAC applied and then are JSON encoded meaning they're never empty and always appear.

This PR updates GetIdentifiedHMAC to ignore default string value ("") which causes some fields to appear in the audit logs with a HMAC'd value for "".

peteski22 avatar Jan 17 '24 12:01 peteski22