-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Issue 844: Redact api token in chat message #1102
Conversation
Debug logs are printing api tokens as part of the request message. Instead of printing the token, the token is tarnsformed into a redacted string if it is not empty. If the token is empty, which is a useful piece of infomation that should be surfaced in the request, the empty string is transformed into a nil string to make it more obvious.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@christophercutajar I see you approved this. Will it be getting merged or was there another release that fixed the issue of the token being exposed in logs? |
@kanata2 when you have time can you please review it yourself and merge it! |
switch token { | ||
case "": | ||
token = "nil" | ||
default: | ||
token = "<REDACTED>" | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If the token is rewritten, will it not be able to authenticate correctly?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This changes affect other than debug logs.
This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days. |
kanata2 I realize that my proposed solution wasn't the proper one, but has this been solved internally by your team in another PR? |
No, we have not worked on it yet. |
Debug logs are printing api tokens as part of the request message.
Instead of printing the token, the token is transformed into a redacted
string if it is not empty. If the token is empty, which is a useful
piece of information that should be surfaced in the request, the empty
string is transformed into a nil string to make it more obvious.
Pull Request Guidelines
These are recommendations for pull requests.
They are strictly guidelines to help manage expectations.
PR preparation
[PASSED] Run
make pr-prep
from the root of the repository to run formatting, linting and tests.Should this be an issue instead - YES IT IS #844
API changes
Since API changes have to be maintained they undergo a more detailed review and are more likely to require changes.
Examples of API changes that do not meet guidelines: