Redact sensitive headers from debug logs#2279
Open
pavel-ptashyts wants to merge 2 commits into
Open
Conversation
Request and response debug logging rendered complete Netty messages, which exposed Authorization values and other credentials. Format logged HTTP messages with shared redaction for authentication and cookie headers. Reuse the same public predicate in DefaultRequest, and avoid rendering complete requests from retry and replay paths. Add regression coverage for HTTP message formatting and request string representations. Fixes AsyncHttpClient#1739 Fixes AsyncHttpClient#1740 Codex on behalf of Pavel Ptashyts Co-Authored-By: Codex <codex@openai.com>
Member
|
I would like to have a system property / environment variable to enable non-redacted logs. It is helpful in debugging at CI pipeline. Probably like AHC_ENABLE_SENSITIVE_LOGGING=true? Of course feel free to choose a better key. |
Redaction is secure by default, but it can prevent diagnosis of authentication failures that only occur in CI. Read a JVM property or environment variable once when the HTTP message formatter is initialized. Fold that immutable setting into isSensitiveHeader so both Netty logging and DefaultRequest use the same decision without repeated configuration lookups. Refs AsyncHttpClient#1739 Refs AsyncHttpClient#1740 Codex on behalf of Pavel Ptashyts Co-Authored-By: Codex <codex@openai.com>
Contributor
Author
|
@hyperxpro Implemented in Sensitive values remain redacted by default. Unredacted logging can be enabled before
The value is calculated once and remains immutable for the process. The JVM property takes precedence over the environment variable, including allowing an explicit Thanks for the suggestion. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DefaultRequestRoot cause
Debug logging passed complete Netty request and response objects to SLF4J. Their
string representations included every header value, so user-supplied
Authorizationheaders and other credentials could be written to applicationlogs.
Sensitive logging
Sensitive values remain redacted by default. Full header values can be enabled
before
HttpMessageFormatteris initialized with either:-Dorg.asynchttpclient.enableSensitiveLogging=trueAHC_ENABLE_SENSITIVE_LOGGING=trueThe JVM property takes precedence over the environment variable. The setting is
read once and remains immutable for the process. Enabling it can expose
credentials and session data in logs.
Validation
./mvnw clean verify: 1,307 tests passed, 17 skipped; Javadocs and Revapi passedCloses #1739
Closes #1740
Codex on behalf of Pavel Ptashyts