melosh/mal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: stop redacting token from request log query params

Browse Source
This commit is contained in:
mkelvers
2026-06-28 12:45:46 +02:00
parent 094d560c30
commit cdcf6a5a2a
2 changed files with 4 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
internal/server/observability.go
View File

@@ -3,7 +3,6 @@ package server
import ( import (
"mal/internal/observability" "mal/internal/observability"
"net/http" "net/http"
"strings"
"time" "time"
"github.com/gin-gonic/gin" "github.com/gin-gonic/gin"
@@ -62,7 +61,7 @@ func requestLogFields(c *gin.Context, path, query, route string, duration time.D
fields["route"] = route fields["route"] = route
} }
if query != "" { if query != "" {
fields["query"] = redactSensitiveQuery(query) fields["query"] = query
} }
if size := c.Writer.Size(); size >= 0 { if size := c.Writer.Size(); size >= 0 {
fields["bytes"] = size fields["bytes"] = size
@@ -83,17 +82,3 @@ func requestLogLevel(status int) observability.LogLevel {
} }
return observability.LogLevelInfo return observability.LogLevelInfo
} }
func redactSensitiveQuery(query string) string {
parts := strings.Split(query, "&")
for i, part := range parts {
key := part
if before, _, ok := strings.Cut(part, "="); ok {
key = before
}
if strings.EqualFold(key, "token") {
parts[i] = key + "=REDACTED"
}
}
return strings.Join(parts, "&")
}

9
internal/server/server_test.go
View File

@@ -149,7 +149,7 @@ func TestRequestLoggerLogsFailedStreamProxy(t *testing.T) {
} }
} }
func TestRequestLoggerRedactsProxyTokenQuery(t *testing.T) { func TestRequestLoggerLogsProxyTokenQuery(t *testing.T) {
gin.SetMode(gin.TestMode) gin.SetMode(gin.TestMode)
var logs bytes.Buffer var logs bytes.Buffer
@@ -172,11 +172,8 @@ func TestRequestLoggerRedactsProxyTokenQuery(t *testing.T) {
t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden) t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
} }
got := logs.String() got := logs.String()
if strings.Contains(got, "secret-token") { if !strings.Contains(got, `query="lang=en&token=secret-token"`) {
t.Fatalf("log line leaked proxy token: %s", got) t.Fatalf("log line missing raw query: %s", got)
}
if !strings.Contains(got, `query="lang=en&token=REDACTED"`) {
t.Fatalf("log line missing redacted query: %s", got)
} }
} }