Removing Authorization headers from logs

[Sachin4403]

We want to skip Authorisation being printed in logs. Anyone who is having access to those logs can harm the system using Authorization and we will never know who did this. Already this is implemented in argus.

https://github.com/xmidt-org/argus/blob/c2562df18c76f64ff59262c55a45bb5804566a00/auth/logger.go#L49-L58

[joe94]

Hey @Sachin4403, I agree. Two suggestions I have heard so far are (1) Follow this implementation you show by removing the sensitive headers and (2) Instead of logging all headers, only log those we think we need.

[Sachin4403]

Hi @joe94,

We need to do something here also.
https://github.com/xmidt-org/tr1d1um/blob/main/main.go#L445
https://github.com/xmidt-org/tr1d1um/blob/main/main.go#L450
https://github.com/xmidt-org/talaria/blob/main/primaryHandler.go#L123

Here we are printing the AuthToken in logs.

[joe94]

@Sachin4403, those entries could be filtered out in your production environment by setting your log level to something above debug (i.e. INFO)

[Sachin4403]

Okay, @joe94 will change the log level.

[joe94]

@Sachin4403, could you mark this question as "answered"/"resolved"? thanks!

[Sachin4403]

@Sachin4403, could you mark this question as "answered"/"resolved"? thanks!

Hi @joe94, I am not getting an option to mark this as resolved. Can you do it from your end?