gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-21 10:43:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

CRITICAL SECURITY FIX: stop logging PBS API tokens in plain text

Browse Source 
- remove token value from debug logs
- only log user, realm, and token name for debugging
- prevents credential exposure in log files
This commit is contained in:
Pulse Monitor
2025-08-11 10:45:03 +00:00
parent 161bbf5ec4
commit 101a263f2d
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/pbs/client.go
+9 -1
View File
@@ -203,10 +203,18 @@ func (c *Client) request(ctx context.Context, method, path string, data url.Valu
// Set authentication
if c.auth.tokenName != "" && c.auth.tokenValue != "" {
// API token authentication
// Note: tokenName already contains just the token part (e.g., "pulse-token")
// after parsing in NewClient, so we reconstruct the full format
authHeader := fmt.Sprintf("PBSAPIToken=%s@%s!%s:%s",
c.auth.user, c.auth.realm, c.auth.tokenName, c.auth.tokenValue)
req.Header.Set("Authorization", authHeader)
log.Debug().Str("authHeader", authHeader).Str("url", req.URL.String()).Msg("Setting PBS API token authentication")
// NEVER log the actual token value - only log that we're using token auth
log.Debug().
Str("user", c.auth.user).
Str("realm", c.auth.realm).
Str("tokenName", c.auth.tokenName).
Str("url", req.URL.String()).
Msg("Setting PBS API token authentication")
} else if c.auth.ticket != "" {
// Ticket authentication
req.Header.Set("Cookie", "PBSAuthCookie="+c.auth.ticket)