zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-07-23 19:20:44 +02:00
Code Issues Projects Releases Packages Wiki Activity

Redact OAuth access token in prod (#2148)

Browse source 
This token is only ever used for logging. The GAE OAuth service will
parse the header directly when called to retrieve the current user and
user id. Logging it in prod could be a security risk if the logs are
leaked.
This commit is contained in:
Lai Jiang 2023-09-14 13:53:56 -04:00 • committed by GitHub
parent 5eb44c165c
commit 2713a10a07
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/src/main/java/google/registry/request/auth/OAuthAuthenticationMechanism.java
View file

@ -26,6 +26,7 @@ import com.google.appengine.api.users.User;
import com.google.common.collect.ImmutableSet; import com.google.common.collect.ImmutableSet;
import com.google.common.flogger.FluentLogger; import com.google.common.flogger.FluentLogger;
import google.registry.config.RegistryConfig.Config; import google.registry.config.RegistryConfig.Config;
import google.registry.config.RegistryEnvironment;
import javax.inject.Inject; import javax.inject.Inject;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
@ -80,7 +81,10 @@ public class OAuthAuthenticationMechanism implements AuthenticationMechanism {
// Assume that, if a bearer token is found, it's what OAuthService will use to attempt // Assume that, if a bearer token is found, it's what OAuthService will use to attempt
// authentication. This is not technically guaranteed by the contract of OAuthService; see // authentication. This is not technically guaranteed by the contract of OAuthService; see
// OAuthTokenInfo for more information. // OAuthTokenInfo for more information.
String rawAccessToken = header.substring(BEARER_PREFIX.length()); String rawAccessToken =
RegistryEnvironment.get() == RegistryEnvironment.PRODUCTION
? "Raw token redacted in prod"
: header.substring(BEARER_PREFIX.length());
// Get the OAuth information. The various oauthService method calls use a single cached // Get the OAuth information. The various oauthService method calls use a single cached
// authentication result, so we can call them one by one. // authentication result, so we can call them one by one.