security: sanitize Basic auth error logging #59

Manually merged

heiko merged 2 commits from fix/55 into master

2026-05-24 16:37:03 +02:00

heiko commented

2026-05-24 15:43:29 +02:00

Owner

Fixes #55.

Summary

sanitize malformed Basic auth errors so raw headers, base64 tokens, decoded payloads, passwords, and password hashes are not echoed
log auth failures with safe remote-address context only
add regression tests for malformed Basic headers

Validation

GOWORK=off go test ./cmd/once-server/auth/ -v -count=1
GOWORK=off go build ./...

Fixes #55. ## Summary - sanitize malformed Basic auth errors so raw headers, base64 tokens, decoded payloads, passwords, and password hashes are not echoed - log auth failures with safe remote-address context only - add regression tests for malformed Basic headers ## Validation - `GOWORK=off go test ./cmd/once-server/auth/ -v -count=1` - `GOWORK=off go build ./...`

heiko added 2 commits

2026-05-24 15:43:29 +02:00

security: sanitize auth error messages to prevent credential leakage ai:claude-sonnet-4-5 d635a149a8

Malformed Authorization headers could place credential-like material
(raw base64 tokens, decoded user:password payloads) into error strings,
which were then written to logs by user.go.

- auth/auth.go: return opaque errors that describe failure class only,
  without echoing header values or decoded payloads
- user.go: log remote address alongside the (now safe) error; helps
  correlate failures without extra context from the header
- auth/auth_test.go: TestBasicSanitizedErrors verifies that none of the
  raw header material appears in any error string

Fixes #55

(co)authored by ai:claude-sonnet-4-5

Sanitize auth error messages to prevent credential leaks ef4b721a22

- Replace error message including password hash with generic message
- Wrap apr1.Hash error to prevent potential credential leaks in error messages
- Ensure auth failure logging includes only sanitized error messages

Fixes #55

heiko commented

2026-05-24 16:36:42 +02:00

Author

Owner

Claude review notes:

Verdict: APPROVE / merge ready
Blockers: none
Major findings: none
Confirmed Basic auth error messages are sanitized and no longer echo raw headers, base64 tokens, decoded payloads, passwords, or password hashes
Confirmed logging uses safe remote-address context only
Confirmed regression tests cover the intended leak cases

Minor suggestions only:

Pre-existing typo: expected 3 for user
Usernames still appear in some auth errors; acceptable for this fix, but could be further sanitized later if desired

Validation reported:

go test ./cmd/once-server/auth PASS
go test -race ./cmd/once-server/auth PASS
go build ./cmd/once-server SUCCESS

Recommendation: merge PR #59.

Claude review notes: - Verdict: APPROVE / merge ready - Blockers: none - Major findings: none - Confirmed Basic auth error messages are sanitized and no longer echo raw headers, base64 tokens, decoded payloads, passwords, or password hashes - Confirmed logging uses safe remote-address context only - Confirmed regression tests cover the intended leak cases Minor suggestions only: - Pre-existing typo: `expected 3 for user` - Usernames still appear in some auth errors; acceptable for this fix, but could be further sanitized later if desired Validation reported: - `go test ./cmd/once-server/auth` PASS - `go test -race ./cmd/once-server/auth` PASS - `go build ./cmd/once-server` SUCCESS Recommendation: merge PR #59.

heiko referenced this pull request from a commit

2026-05-24 16:37:02 +02:00

Merge pull request #59 from fix/55

heiko manually merged commit 4d7228a0ff into master

2026-05-24 16:37:03 +02:00

heiko deleted branch fix/55

2026-05-24 16:37:44 +02:00