Skip to content

Remove reconstructed XSRF token from log#3141

Merged
gbrodman merged 1 commit into
google:masterfrom
gbrodman:xsrfTokenLog
Jul 9, 2026
Merged

Remove reconstructed XSRF token from log#3141
gbrodman merged 1 commit into
google:masterfrom
gbrodman:xsrfTokenLog

Conversation

@gbrodman

@gbrodman gbrodman commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

A.3 #13


This change is Reviewable

Comment thread core/src/main/java/google/registry/security/XsrfTokenManager.java Fixed
Comment thread core/src/main/java/google/registry/security/XsrfTokenManager.java Fixed
if (!MessageDigest.isEqual(token.getBytes(UTF_8), reconstructedToken.getBytes(UTF_8))) {
logger.atWarning().log(
"Reconstructed XSRF mismatch (got != expected): %s != %s", token, reconstructedToken);
logger.atWarning().log("Token %s didn't match expected reconstructed token", token);
if (!MessageDigest.isEqual(token.getBytes(UTF_8), reconstructedToken.getBytes(UTF_8))) {
logger.atWarning().log(
"Reconstructed XSRF mismatch (got != expected): %s != %s", token, reconstructedToken);
logger.atWarning().log("Token %s didn't match expected reconstructed token", token);
@gbrodman gbrodman requested a review from weiminyu July 9, 2026 15:35

@weiminyu weiminyu left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@weiminyu reviewed 1 file and all commit messages.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on gbrodman).

@gbrodman gbrodman added this pull request to the merge queue Jul 9, 2026
Merged via the queue into google:master with commit c785365 Jul 9, 2026
14 of 16 checks passed
@gbrodman gbrodman deleted the xsrfTokenLog branch July 9, 2026 16:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants