fix: redact authorization tokens from trace logs - #218
Conversation
|
note... had to pin zeroize in new commit due to MSRV: |
| let redacted = redact_authorization(raw); | ||
| let request: serde_json::Value = serde_json::from_slice(&redacted).unwrap(); | ||
|
|
||
| assert_eq!(request["authorization"], "<redacted>"); |
There was a problem hiding this comment.
nit: I think we can use the constant value REDACTED_AUTHORIZATION here
There was a problem hiding this comment.
Good catch, done. Both test assertions now use REDACTED_AUTHORIZATION.
f50ec35 to
c9372db
Compare
c9372db to
3130ac5
Compare
3130ac5 to
3e12007
Compare
3e12007 to
a59df78
Compare
|
@EddieHouston I did pushed a commit to fix the CI, and some others with a different approach. Let me know what you think. I don't want this one to be a breaking change, so we can have it as patch release. However, I think the ideal solution would be to have this constraint at type level as follow-up. |
- introduce `Request::redacted`, which returns a copy of the request with the authorization token replaced by a `<REDACTED>` placeholder - trace the redacted request in `RawClient::call` instead of the raw wire bytes Signed-off-by: Leonardo Lima <oleonardolima@users.noreply.github.com>
- collect the batch requests into a Vec so the wire bytes and the trace log both derive from the same source - serialize each request through `Request::redacted` in the trace line Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Leonardo Lima <oleonardolima@users.noreply.github.com>
a59df78 to
77f9c78
Compare
|
ping @luisschwab |
|
@oleonardolima missing the changelog entry |
Fine with me, as long as it builds... pinning whatever needs to is great 👍 |
4 participants
fixes #215.
Description
The
authorizationtoken added viaAuthProvider(#194) was logged verbatimat TRACE level in
callandbatch_call, since both traced the raw wirebytes.
This redacts the token before serialization instead of inspecting serialized
bytes:
Request::redactedreturns a copy of the request with thetoken replaced by
<REDACTED>calltraces the redacted request;batch_callcollects its requests intoa
Vecand derives both the wire bytes and the trace output from itNotes to the reviewers
Redacting the struct before serialization removes the JSON re-parse and the
fail-closed path of the previous approach, and keeps the trace line in the
same field order as the wire format.
batch_callstill attaches the tokenonly to the first request of the batch.
Changelog notice
Checklists
All Submissions:
Bugfixes: