{Logging} Redact token headers from SDK HTTP log#17671
Conversation
|
Logging |
| *_, external_tenant_tokens = cred.get_all_tokens(*scopes) | ||
| # Hard-code scheme to 'Bearer' as _BearerTokenCredentialPolicyBase._update_headers does. | ||
| client_kwargs['headers']['x-ms-authorization-auxiliary'] = \ | ||
| ', '.join("Bearer {}".format(t[1]) for t in external_tenant_tokens) |
There was a problem hiding this comment.
Just curious, always Bearer token here?
There was a problem hiding this comment.
Yes. The comment at L182 explains that:
| if isinstance(http_request.body, types.GeneratorType): | ||
| _LOGGER.debug("File upload") | ||
| return | ||
| try: | ||
| if isinstance(http_request.body, types.AsyncGeneratorType): | ||
| _LOGGER.debug("File upload") | ||
| return |
There was a problem hiding this comment.
In storage track1 data plane SDK, for such file, it will logging with file size. Could we also support it here?
There was a problem hiding this comment.
This SafeNetworkTraceLoggingPolicy is designed as a generic policy. That's why I am hesitating to apply it to all SDKs (including data-plane SDKs) at the beginning.
If storage data-plane SDK or other data-plane SDKs requires additional/special logic, we may apply SafeNetworkTraceLoggingPolicy only to ARM and let data-plane SDKs decide what policy they want.
Another solution is to define your own policy and override
azure-cli/src/azure-cli-core/azure/cli/core/commands/client_factory.py
Lines 155 to 156 in 36e3d15
There was a problem hiding this comment.
We could keep current design then.
jiasli
changed the title
6 participants
Resolve #17625
Context
azure-core1.13.0,Authorizationheader is now exposed in DEBUG log (Make NetworkTraceLoggingPolicy show the auth token in plain text azure-sdk-for-python#17424).x-ms-authorization-auxiliaryheader (x-ms-authorization-auxiliary header should be redacted azure-sdk-for-python#17271).Changes
Create a custom policy
SafeNetworkTraceLoggingPolicyto replaceNetworkTraceLoggingPolicy. It by default redactsAuthorizationandx-ms-authorization-auxiliary. Any client factory callingprepare_client_kwargs_track2will have this policy configured.Testing Guide
Any Track 2 mgmt-plane command, like