Skip to content

Redact access token from PolarisCredential toString#4752

Closed
vigneshio wants to merge 1 commit into
apache:mainfrom
vigneshio:fix-token-redaction-in-logs
Closed

Redact access token from PolarisCredential toString#4752
vigneshio wants to merge 1 commit into
apache:mainfrom
vigneshio:fix-token-redaction-in-logs

Conversation

@vigneshio

@vigneshio vigneshio commented Jun 14, 2026

Copy link
Copy Markdown
Contributor

DefaultAuthenticator logs PolarisCredential at DEBUG and WARN (including on failed principal resolution). Immutables toString() previously included the raw bearer token.

Add @Value.Redacted on getToken(), matching the existing pattern on PolarisPrincipal.getToken(). Programmatic access is unchanged; only log output is affected.

Checklist

  • Don't disclose security issues! (contact security@apache.org)
  • Clearly explained why the changes are needed, or linked related issues: Fixes #
  • Added/updated tests with good coverage, or manually tested (and explained how)
  • Added comments for complex logic
  • Updated CHANGELOG.md (if needed)
  • Updated documentation in site/content/in-dev/unreleased (if needed)

import java.util.Set;
import org.junit.jupiter.api.Test;

class PolarisCredentialTest {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would remove this test. It's actually testing the Java Immutables library, not Polaris code.

@vigneshio
vigneshio force-pushed the fix-token-redaction-in-logs branch from 6c514cf to f0d25ea Compare June 15, 2026 13:15
DefaultAuthenticator logs PolarisCredential at DEBUG and WARN; toString()
previously included the raw bearer token. Add @Value.Redacted on getToken(),
matching PolarisPrincipal.
@vigneshio
vigneshio force-pushed the fix-token-redaction-in-logs branch from f0d25ea to 666c836 Compare June 15, 2026 13:17
@vigneshio vigneshio closed this Jun 15, 2026
@github-project-automation github-project-automation Bot moved this from PRs In Progress to Done in Basic Kanban Board Jun 15, 2026
@vigneshio
vigneshio deleted the fix-token-redaction-in-logs branch June 15, 2026 13:31
@vigneshio
vigneshio restored the fix-token-redaction-in-logs branch June 15, 2026 14:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants