From 101a263f2d49448d0c7934fa422812f8ce72d2fa Mon Sep 17 00:00:00 2001 From: Pulse Monitor Date: Mon, 11 Aug 2025 10:45:03 +0000 Subject: [PATCH] CRITICAL SECURITY FIX: stop logging PBS API tokens in plain text - remove token value from debug logs - only log user, realm, and token name for debugging - prevents credential exposure in log files --- pkg/pbs/client.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkg/pbs/client.go b/pkg/pbs/client.go index 1b4d1ec8f..3d42f70cb 100644 --- a/pkg/pbs/client.go +++ b/pkg/pbs/client.go @@ -203,10 +203,18 @@ func (c *Client) request(ctx context.Context, method, path string, data url.Valu // Set authentication if c.auth.tokenName != "" && c.auth.tokenValue != "" { // API token authentication + // Note: tokenName already contains just the token part (e.g., "pulse-token") + // after parsing in NewClient, so we reconstruct the full format authHeader := fmt.Sprintf("PBSAPIToken=%s@%s!%s:%s", c.auth.user, c.auth.realm, c.auth.tokenName, c.auth.tokenValue) req.Header.Set("Authorization", authHeader) - log.Debug().Str("authHeader", authHeader).Str("url", req.URL.String()).Msg("Setting PBS API token authentication") + // NEVER log the actual token value - only log that we're using token auth + log.Debug(). + Str("user", c.auth.user). + Str("realm", c.auth.realm). + Str("tokenName", c.auth.tokenName). + Str("url", req.URL.String()). + Msg("Setting PBS API token authentication") } else if c.auth.ticket != "" { // Ticket authentication req.Header.Set("Cookie", "PBSAuthCookie="+c.auth.ticket)