Uploaded image for project: 'Red Hat 3scale API Management'
  1. Red Hat 3scale API Management
  2. THREESCALE-6899

Avoid logging access_tokens

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Done
    • Icon: Major Major
    • None
    • 2.9 GA
    • System
    • False
    • False
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Undefined

      The request is to avoid logging access tokens.
      Currently when an API request that contains an access token is performed, system logs the access token.

      e.g.:

      access_token in query param

      Started GET "/admin/api/accounts.xml?access_token=cc04c2c0ff5c77b080bbc27541350134332e7c7afa05aeb8921697bb0e82c872&page=1&per_page=500" for 192.168.130.1 at 2021-03-30 12:42:29 +0000
Processing by Admin::Api::AccountsController#index as XML
  Parameters: {"access_token"=>"cc04c2c0ff5c77b080bbc27541350134332e7c7afa05aeb8921697bb0e82c872", "page"=>"1", "per_page"=>"500"}

      access_token in body param

      Started GET "/admin/api/accounts.xml?page=1&per_page=500" for 192.168.130.1 at 2021-03-30 12:41:43 +0000
Processing by Admin::Api::AccountsController#index as XML
  Parameters: {"access_token"=>"cc04c2c0ff5c77b080bbc27541350134332e7c7afa05aeb8921697bb0e82c872", "page"=>"1", "per_page"=>"500", "account"=>{"access_token"=>"cc04c2c0ff5c77b080bbc27541350134332e7c7afa05aeb8921697bb0e82c872"}}

              Unassigned Unassigned
              rhn-support-sillumin Samuele Illuminati (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: