The api key in the st2api log is not obfuscated

[jinpingh]

SUMMARY

The user found in clean API key in query request (for the load balancer health check)
GET /api/v1/?st2-api-key=foo HTTP/1.1

ISSUE TYPE

• Bug Report

STACKSTORM VERSION

st2 2.10.3, on Python 2.7.12

[nmaludy]

Can they just set the API key as a header value instead of in the URL? https://docs.stackstorm.com/authentication.html#api-key-usage

[bigmstone]

@nmaludy Probably, but we should obfuscate it on all our valid methods of providing the key.

[Kami]

Yeah, providing API key as a query param is meant as a last resort for integration with services which don't support sending custom headers, because it's not safe (a lot of external services will log full URL with query params).

Having said that, @bigmstone is correct. We should still not log in in st2api log file.

@jinpingh Thanks for reporting this and good catch.

The log line you provided doesn't look like st2api log line. Is that from load balancer log file? If that's the case, there is nothing we can do about load balancer logging that query param, we can just filter it on the API side.

Here is an example of how st2api log line looks like:

2019-03-13 09:09:27,601 INFO [-] 9d6e473e-d7da-4e07-bbec-d81af1b4bf95 - GET /v1 with query={'st2-api-key': ['bar']} (method='GET',path='/v1',remote_addr='127.0.0.1',query={'st2-api-key': ['bar']},request_id='9d6e473e-d7da-4e07-bbec-d81af1b4bf95')
2019-03-13 09:09:27,603 INFO [-] 9d6e473e-d7da-4e07-bbec-d81af1b4bf95 - 200 80 1.469ms (method='GET',path='/v1',remote_addr='127.0.0.1',status=200,runtime=1.469,content_length=80,request_id='9d6e473e-d7da-4e07-bbec-d81af1b4bf95')