Remove API token from logs #727
Comments
|
Instead of removing the token from the logs we could add a new authentication method. We could use a bearer token authentication scheme. We are using it in the Index, so we only need to adapt that code: https://github.com/torrust/torrust-index/blob/develop/src/web/api/server/v1/auth.rs Maybe we can keep the GET param token for testing because it makes it easier to load API resources. However, I would remove it, we can use https://www.postman.com/ or curl. |
|
Hi @da2ce7 I think I will make an small improvement for now. I will allow to include the token not only via a URL param but also as a Authorization Header. I think that would require two small changes:
Since we are planning big changes in APIs: We can postpone to decide which method to use. Maybe It would be useful to have some kind of users also in the tracker and a more advance token generation:
|
josecelano
added a commit
to josecelano/torrust-tracker
that referenced
this issue
Mar 10, 2025
The API allos client authentication via a `token` parameter in the URL query: ```console curl http://0.0.0.0:1212/api/v1/stats?token=MyAccessToken | jq ``` Now it's also possible to do it via Authentication Header: ```console curl -H "Authorization: Bearer MyAccessToken" http://0.0.0.0:1212/api/v1/stats | jq ``` This is to avoid leaking the token in logs, proxies, etc. For now, it's only optional and recommendable. It could be mandatory in future major API versions.
josecelano
added a commit
to josecelano/torrust-tracker
that referenced
this issue
Mar 10, 2025
The API allos client authentication via a `token` parameter in the URL query: ```console curl http://0.0.0.0:1212/api/v1/stats?token=MyAccessToken | jq ``` Now it's also possible to do it via Authentication Header: ```console curl -H "Authorization: Bearer MyAccessToken" http://0.0.0.0:1212/api/v1/stats | jq ``` This is to avoid leaking the token in logs, proxies, etc. For now, it's only optional and recommendable. It could be mandatory in future major API versions.
josecelano
added a commit
to josecelano/torrust-tracker
that referenced
this issue
Mar 10, 2025
The API allos client authentication via a `token` parameter in the URL query: ```console curl http://0.0.0.0:1212/api/v1/stats?token=MyAccessToken | jq ``` Now it's also possible to do it via Authentication Header: ```console curl -H "Authorization: Bearer MyAccessToken" http://0.0.0.0:1212/api/v1/stats | jq ``` This is to avoid leaking the token in logs, proxies, etc. For now, it's only optional and recommendable. It could be mandatory in future major API versions.
josecelano
added a commit
to josecelano/torrust-tracker
that referenced
this issue
Mar 10, 2025
The API allos client authentication via a `token` parameter in the URL query: ```console curl http://0.0.0.0:1212/api/v1/stats?token=MyAccessToken | jq ``` Now it's also possible to do it via Authentication Header: ```console curl -H "Authorization: Bearer MyAccessToken" http://0.0.0.0:1212/api/v1/stats | jq ``` This is to avoid leaking the token in logs, proxies, etc. For now, it's only optional and recommendable. It could be mandatory in future major API versions.
josecelano
added a commit
to josecelano/torrust-tracker
that referenced
this issue
Mar 10, 2025
Instead of passing the `token` via GET param. The server supports both. Since we have not released any version crate for the client yet we can use the header by deafault which is more secure.
josecelano
added a commit
that referenced
this issue
Mar 10, 2025
…uthentication header 34f2f43 refactor: [#727] use the Authentication header in the API client (Jose Celano) 084beb2 feat: [#727] allow to authenticate API via authentication header (Jose Celano) Pull request description: The API allows client authentication via a `token` parameter in the URL query: ```console curl http://0.0.0.0:1212/api/v1/stats?token=MyAccessToken | jq ``` Now it's also possible to do it via an `Authentication Header`: ```console curl -H "Authorization: Bearer MyAccessToken" http://0.0.0.0:1212/api/v1/stats | jq ``` This is to avoid leaking the token in logs, etc. For now, it's only optional and recommendable. It could be mandatory in future major API versions. The API client uses by default the `Authentication Header`. It could be a breaking change if you use the newer client witn an old API that does not support it. However we have not released any crate for the API client yet. And [we are still using a different client in the Index](torrust/torrust-index#806). ACKs for top commit: josecelano: ACK 34f2f43 Tree-SHA512: 94e83465f0f105200ea4257aa9a8e1f15b810410fd421e30f286cbea4bd47f3917a83088337ca6608f572f828f82f5a90aa18298763821c1c5e0da7e02c7ea6a
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
We are using a
tokenquery param for API authentication and we are logging the whole request URL.That means tokens are included in the logs.
We should hide those tokens with **** or change the way we pass the token. We could use an HTTP header like in the Index. I prefer the second option because other proxies could also log the URLs.
The text was updated successfully, but these errors were encountered: