[MINOR] Prevent WebSocket tickets from being logged

[jongyoul]

What is this PR for?

This fixes CVE-2026-44614, where the WebSocket bearer ticket could be written to server or browser diagnostic logs in plaintext.

The login and security ticket endpoints no longer log their complete ticket-bearing responses. Server-side WebSocket handling now logs only non-secret operation, principal, success, and error type metadata instead of the complete message, payload, or exception details. The active Angular SDK and classic UI likewise log only operation/principal metadata rather than complete WebSocket messages.

Ticket response bodies, authentication behavior, and the WebSocket wire protocol remain unchanged. Both clients still attach the bearer ticket to outbound WebSocket frames, but no longer copy it or the complete payload to the browser console.

What type of PR is it?

Hot Fix

Todos

• Remove ticket-bearing REST response logging
• Remove raw WebSocket message logging at DEBUG, TRACE, and ERROR
• Remove ticket-bearing WebSocket message logging from both browser clients
• Add regression coverage for login, /api/security/ticket, WebSocket failures, and classic-client console logging

What is the Jira issue?

Not applicable. This addresses CVE-2026-44614.

How should this be tested?

• ./mvnw -pl zeppelin-server --am -Dtest=SecurityRestApiTest,NotebookServerLoggingTest,NotebookServerTest -Dsurefire.failIfNoSpecifiedTests=false -Dmaven.gitcommitid.skip=true test
  • 27 tests passed with no failures, errors, or skips.
• cd zeppelin-web && npm run karma-test
  • 184 tests passed, including the two new WebSocket console regression tests.
• cd zeppelin-web-angular && npm run build-project:sdk
  • SDK build passed.
• Focused ESLint and Prettier checks passed for both changed clients.
• A built-SDK sentinel smoke test confirmed that ticket and payload remain in the transmitted message but are absent from browser console arguments.
• Apache RAT passed for zeppelin-server, zeppelin-web-angular, and zeppelin-web with no unapproved licenses.
• git diff --check apache/master...HEAD

The standalone checkstyle:check command reports the same existing baseline on clean apache/master and this branch: 1,795 repository-wide violations and 103 violations when restricted to the original server files. No violation is reported on a line added or modified by this PR.

Screenshots (if appropriate)

Not applicable.

Questions:

• Does the license files need to update? No.
• Is there breaking changes for older versions? No.
• Does this needs documentation? No.

[Copilot]

Pull request overview

This PR mitigates CVE-2026-44614 by ensuring WebSocket bearer tickets (and other potentially sensitive payload data) are no longer written to server logs, while keeping response bodies, authentication behavior, and the WebSocket protocol unchanged.

Changes:

• Replaced ticket-bearing REST response logging in LoginRestApi and SecurityRestApi with structured, non-secret metadata logs (principal + success).
• Replaced raw WebSocket message/error logging in NotebookServer with operation/principal metadata and a sanitized error type (no payload / msg dump / exception details).
• Added regression tests to assert tickets and payloads are not present in logs for login, /api/security/ticket, and a WebSocket failure path.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
zeppelin-server/src/main/java/org/apache/zeppelin/rest/LoginRestApi.java	Stops logging full login responses; logs only principal and success metadata.
zeppelin-server/src/main/java/org/apache/zeppelin/rest/SecurityRestApi.java	Stops logging full ticket responses; logs only principal and success metadata.
zeppelin-server/src/main/java/org/apache/zeppelin/socket/NotebookServer.java	Removes raw WebSocket message logging and sanitizes error logging to avoid leaking tickets/payloads.
zeppelin-server/src/test/java/org/apache/zeppelin/rest/SecurityRestApiTest.java	Adds tests verifying tickets are not present in login/ticket endpoint logs.
zeppelin-server/src/test/java/org/apache/zeppelin/socket/NotebookServerLoggingTest.java	Adds test verifying tickets/payload are not present in WebSocket failure logs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.