Secure data is being logged

[tyndra]

I’ve noticed that several modules log the sensitive information: connection strings, and data sources configuration that includes auth tokens. Disabling logging for those modules via OPAL_LOG_MODULE_EXCLUDE_LIST prevents sensitive info from being printed, but hides useful diagnostic logs.

Any suggestions?

[orweis]

Hi @tyndra , can you share examples of the problematic log lines to better help us adderss?

I general I'd suggest three options:

• have your secrets moved to non sensitive spots (e.g. a custom data-fetcher)
• push a PR to change the logging on the current sensitive spots (removing the log, removing content from the log, or adding filtering options)
• keeping logs outputted as is and filtering things out via another tool before sending outwards

[orweis]

Hi @tyndra I can't seem to find this log line in the current code base; which version of OPAL are you using?
Perhaps consider updating ?

[tyndra]

FROM permitio/opal-server:0.7.5

[orweis]

Well you're in luck - this was fixed / changed in 0.7.6 - as part of another change that moved the periodic updates to be managed in the OPAL-client instead of the server.

[tyndra]

v 0.7.6 fixes the original issue. Thanks.

I found another case: If OPAL_DEFAULT_UPDATE_CALLBACKS is misconfigured it is logged include tokens

[orweis]

Can you share an example of said log for OPAL_DEFAULT_UPDATE_CALLBACKS?