SMOODEV-2716: Redact client_secret from url-encoded request-body logging#94
Open
brentrager wants to merge 1 commit into
Open
SMOODEV-2716: Redact client_secret from url-encoded request-body logging#94brentrager wants to merge 1 commit into
brentrager wants to merge 1 commit into
Conversation
The request/response logger stored the raw form body as an opaque string, so an OAuth client_credentials token exchange leaked its client_secret to CloudWatch in plaintext (surfaced during the AuthIssuer P0). The logger redacts by object key, but a url-encoded body isn't an object it can see into. getRequestBody now scrubs sensitive x-www-form-urlencoded params via the new exported redactFormCredentials (splits on the first `=` so base64 padding survives; leaves JSON bodies untouched). Covers all body log sites since they route through getRequestBody. TypeScript only — Python/Rust/Go/.NET parity is a follow-up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018tRq2Rge3gGHCjJdNx6xDD
🦋 Changeset detectedLatest commit: f0e4980 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The request/response logger records the outbound request body via
getRequestBody, which returned a url-encoded form body verbatim as an opaque string. The logger redacts by object key (headers, JSON fields) but can't see into a string, so an OAuthclient_credentialstoken exchange loggedclient_secret=sk_...in plaintext to CloudWatch.Surfaced during the AuthIssuer P0 (SMOODEV-2716):
@smooai/config'sTokenProvider.refreshdoesPOST /tokenwithgrant_type=client_credentials&client_id=...&client_secret=sk_..., and that whole body landed in logs.Fix
getRequestBodynow runs string bodies through the new exportedredactFormCredentials, which scrubs sensitivex-www-form-urlencodedparams (client_secret,client_id,access_token,refresh_token,token,password,secret,code,assertion,client_assertion,api_key) to[REDACTED]. It:=so base64 values with=padding survive,{/[; the logger key-redacts those),Tests
src/fetch.redact.test.ts— 3 tests (redacts secret/id while preserving base64 padding; leaves benign form bodies unchanged; doesn't corrupt JSON).tsc --noEmitclean.Scope / follow-up
TypeScript only. This is the language
@smooai/configuses, so it stops the reported leak. The Python / Rust / Go / .NET implementations of@smooai/fetchhave the same body-logging shape and need the same redaction — parity follow-up, intentionally not bundled into this incident fix.Note: the leaked secret is already in CloudWatch history until log retention expires — rotation is flagged for Brent separately.
Jira: SMOODEV-2716
🤖 Generated with Claude Code
https://claude.ai/code/session_018tRq2Rge3gGHCjJdNx6xDD