fix(oauth2): mask sensitive tokens in HTTP logs

[lqiu96]

Disables automatic logging by google-http-java-client throughout the auth library to prevent leakage of sensitive tokens like (access_token and subject_token). Token masking logging via LoggingUtils is introduced instead, which hashes sensitive keys.

This was discovered in use cases where info level logging was enabled and CIs were outputting Bearer Token values.

See b/456079208 and b/465090182 for more info

Behavior change

• HttpRequests are no longer being logged as they may contains sensitive information. This also removes transport specific logs that output the request and response data.
• Info is going to be logged via LoggingUtils (Client Library Debug Logging) and the logs must be explicitly enabled via the Env Var. The different log levels configured INFO vs DEBUG will output different data (request, response, or payload)

[lqiu96]

Should we also mask content in

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jLoggingHelpers.java

Line 98 in c3d80ef

String jsonData = gson.toJson(((JsonHttpContent) request.getContent()).getData());

for Json?

[zhumin8]

Should we also mask content in

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jLoggingHelpers.java

Line 98 in c3d80ef

String jsonData = gson.toJson(((JsonHttpContent) request.getContent()).getData());

for Json?

We can. I don't recall exactly what is in the content. In practice, I think we only want to hash where absolutely necessary, otherwise log with all hash don't provide much value. Again, this is under terms that this logging is not designed for production usage, but for debug purposes only. See warnings in guide.

[lqiu96]

Should we also mask content in

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jLoggingHelpers.java

Line 98 in c3d80ef

String jsonData = gson.toJson(((JsonHttpContent) request.getContent()).getData());

for Json?

We can. I don't recall exactly what is in the content. In practice, I think we only want to hash where absolutely necessary, otherwise log with all hash don't provide much value. Again, this is under terms that this logging is not designed for production usage, but for debug purposes only. See warnings in guide.

Gotcha. I just added reference to it just in case. Looks like if there is no match to sensitive keys, it'll just keep it as-is. I think that should be fine since it's most likely the case that the JsonHttpContent doesn't have anything that needs to be masked.

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[zhumin8]

LGTM