Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Google Cloud API credentials logged in full on http/401 response #1001

Open
ptashek opened this issue Mar 12, 2024 · 1 comment
Open

Google Cloud API credentials logged in full on http/401 response #1001

ptashek opened this issue Mar 12, 2024 · 1 comment
Assignees
Labels
Do this next This is the next thing I'm going to do

Comments

@ptashek
Copy link

ptashek commented Mar 12, 2024

Thank you for this integration. Does the job perfectly, and setting up with my own API credentials was a breeze.

Going through logs I've noticed the integration logs the full user provided client_id and client_secret if Google responds with a http/401. This likely doesn't pose a security risk as such as the credentials are wrong, but I'd say it's safer to assume worst-case scenario and redact those details before logging the error.

03-10 11:21:02 ERROR Error serving GET http://<redacted>/manualauth?client_id=<this_is_logged>&client_secret=<this_is_logged>

03-10 11:21:02 ERROR 
  addon/backup/ui/uiserver.py:801 (error_middleware)
  addon/backup/ui/uiserver.py:278 (manualauth)
  addon/backup/drive/authcodequery.py:42 (requestCredentials)
  
backup.exceptions.exceptions.GoogleCredGenerateError: Google responded with error status HTTP 401.  Please verify your credentials are set up correctly.
@sabeechen sabeechen self-assigned this Mar 31, 2024
@sabeechen sabeechen added the Do this next This is the next thing I'm going to do label Mar 31, 2024
@sabeechen
Copy link
Owner

Thanks for pointing that out, I'll sanitize it in the next version

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Do this next This is the next thing I'm going to do
Projects
None yet
Development

No branches or pull requests

2 participants