Bug 1734390: don't log Authorization header when Basic Auth fails #129
Conversation
openshift-ci-robot
added
the
bugzilla/valid-bug
|
@stlaz: This pull request references a valid Bugzilla bug. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
size/XS
openshift-ci-robot
added
size/S
Basic auth looks at the Authorization header and checks that its purpose is to serve for basic auth (starts with "Basic"). It would log it if this check fails which might print the bearer token in cases where e.g. service account already has its token and just wants to access the armored endpoints.
stlaz
force-pushed
the
nolog_token
branch
18 times, most recently
from
6f56d73 to
60999af
Compare
|
@mrogers950 @enj anything blocking this? |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mrogers950, stlaz The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
5 participants
Basic auth looks at the Authorization header and checks that its
purpose is to serve for basic auth (starts with "Basic"). It would
log it if this check fails which might print the bearer token in
cases where e.g. service account already has its token and just wants
to access the armored endpoints.
cc @enj @mrogers950