security: avoid logging Basic auth material (ai:gpt-5) #55

New issue

Closed

opened 2026-05-23 22:21:09 +02:00 by heiko · 1 comment

heiko commented

2026-05-23 22:21:09 +02:00

Owner

Finding from a whole-codebase security review.

Affected code:

cmd/once-server/auth/auth.go:28-31 includes the supplied Base64 token or decoded Basic-auth payload in returned error strings for malformed headers.
cmd/once-server/user.go:23-25 logs those errors.

Impact:
Malformed Authorization headers can place credential-like material into application logs. For example, a decoded Basic payload without the expected delimiter is logged in full. Logs often have a wider audience and longer retention than request handling, so authentication material should not be copied there even on parse errors.

Suggested fix:

Return sanitized auth errors that describe the class of failure without including raw header values, decoded payloads, or passwords.
Log only safe context such as remote address and an optional sanitized username when one is known.
Add tests that malformed Basic headers do not appear in error strings.

Finding from a whole-codebase security review. Affected code: - cmd/once-server/auth/auth.go:28-31 includes the supplied Base64 token or decoded Basic-auth payload in returned error strings for malformed headers. - cmd/once-server/user.go:23-25 logs those errors. Impact: Malformed Authorization headers can place credential-like material into application logs. For example, a decoded Basic payload without the expected delimiter is logged in full. Logs often have a wider audience and longer retention than request handling, so authentication material should not be copied there even on parse errors. Suggested fix: - Return sanitized auth errors that describe the class of failure without including raw header values, decoded payloads, or passwords. - Log only safe context such as remote address and an optional sanitized username when one is known. - Add tests that malformed Basic headers do not appear in error strings.

heiko commented

2026-05-24 15:00:25 +02:00

Author

Owner