realtime-py icon indicating copy to clipboard operation
realtime-py copied to clipboard

chore: adding a logger masking filter

Open staaldraad opened this issue 1 year ago • 3 comments

What kind of change does this PR introduce?

Bug fix / feature

What is the current behavior?

INFO log lines may contain the access_token jwt

What is the new behavior?

Use a logging.Filter to redact JWT tokens that may be in log messages. JWT's will be displayed as eyJh.REDACTED.2j7_78f where eyJh would be the full header and 2j7_78f would be the full signature.

$ python3 app.py                                                                                                                                                                                                                                                                                                                
2024-10-01 12:44:53,590:INFO - Connection was successful
2024-10-01 12:44:53,777:INFO - Connection was successful
2024-10-01 12:44:53,778:INFO - send: {"topic": "realtime:test-broadcast", "event": "phx_join", "payload": {"config": {"broadcast": {"self": true}, "presence": {"key": ""}, "private": false, "postgres_changes": []}, "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.REDACTED.2j7_78fvwrR3Ok3zTWOrPmS4HgvAY8xWpMdTM7MX-bg"}, "ref": "1", "join_ref": "1"}
2024-10-01 12:44:54,780:INFO - send: {"topic": "realtime:test-broadcast", "event": "broadcast", "payload": {"type": "broadcast", "event": "test-event", "payload": {"message": "Event 1"}}, "ref": "2", "join_ref": "1"}
2024-10-01 12:44:54,781:INFO - send: {"topic": "realtime:test-broadcast", "event": "broadcast", "payload": {"type": "broadcast", "event": "test-event", "payload": {"message": "Event 2"}}, "ref": "3", "join_ref": "1"}

Additional context

~Doesn't address the fact that logging set to DEBUG will have the JWT in the connection log line created by websockets.~ Websocket DEBUG logs are also redacted after adding https://github.com/supabase/realtime-py/pull/217/commits/053221bf99e5dd47e0c8dd0cb4d21b84801acb5b

staaldraad avatar Oct 01 '24 10:10 staaldraad