Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent tcportal logging full request content with authorization #76

Conversation

ashleysmithTTD
Copy link
Contributor

@ashleysmithTTD ashleysmithTTD commented Sep 18, 2024

What Changed:

  1. Added blacklist for authorization header (see loggingHelpers.ts in uid2-self-serve-portal for reference)

Test Plan:

  1. Run yarn uid2 and also make sure local operator is running
  2. Open Powershell ISE
  3. Paste this script to add an authorization header
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add('authorization','Bearer 123456')

Invoke-WebRequest -Uri http://localhost:3000/ -Headers $headers -Method GET 
  1. Comment out line 32 in app.ts ( //app.use(getLoggingMiddleware()) to simulate the code before this PR, run the above command in ISE, and observe the authorization bearer token in the terminal logs
  2. Uncomment out line 32, run the code in ISE again, and make sure the authorization header cannot be seen in the terminal logs
  3. Run yarn euid and repeat steps 2-6.
TCPortalBearerTokenTesting.mp4

@ashleysmithTTD ashleysmithTTD merged commit 594e6b7 into main Sep 18, 2024
3 checks passed
@ashleysmithTTD ashleysmithTTD deleted the ans-UID2-3670-prevent-tcportal-logging-full-request-content branch September 18, 2024 22:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants