Secure data is being logged

[tyndra]

I’ve noticed that several modules log the sensitive information: connection strings, and data sources configuration that includes auth tokens. Disabling logging for those modules via OPAL_LOG_MODULE_EXCLUDE_LIST prevents sensitive info from being printed, but hides useful diagnostic logs.

Any suggestions?

[orweis]

Hi @tyndra , can you share examples of the problematic log lines to better help us adderss?

I general I'd suggest three options:

• have your secrets moved to non sensitive spots (e.g. a custom data-fetcher)
• push a PR to change the logging on the current sensitive spots (removing the log, removing content from the log, or adding filtering options)
• keeping logs outputted as is and filtering things out via another tool before sending outwards

[tyndra]

@orweis, one more use case when sensitive data is being logged:

If callback server responds with an error (like 500) the OPAL_DEFAULT_UPDATE_CALLBACK_CONFIG is logged including token

[orweis]

1. You're welcome to open a PR to remove these from the logs (unless an env-var to show them is included)
2. As an intermediate solution I'd suggest not passing tokens via the fetcher config, but instead passing only an indicator for the secret and having a custom data fetcher load it directly

[tyndra]

Open PR or Issue?

[orweis]

PR. Only if you want to work on this, of course. An issue otherwise.

[tyndra]

Created an issue: #596