Visitar URL original
fix(oauth2): mask sensitive tokens in HTTP logs (#1900) · googleapis/google-cloud-java@3e4ccb7 · GitHub
Skip to content

Commit 3e4ccb7

Browse files
lqiu96lqiu96
authored
fix(oauth2): mask sensitive tokens in HTTP logs (#1900)
* fix(oauth2): mask sensitive tokens in HTTP logs Disables automatic logging by google-http-java-client in StsRequestHandler and UrlIdentityPoolSubjectTokenSupplier to prevent leakage of access_token and subject_token. Explicit secure logging via LoggingUtils is introduced instead, which hashes sensitive keys. * chore: Remove Code Coverage requirements (#1871) * chore: Remove Code Coverage requirements * chore: Remove redelcaration in child pom * chore: Disable request logging for all credential types * chore: Restore removed logs * chore: Fix lint issues * chore: Add comments and accessToken sensitive token * chore: Fix lint issues * test: add Token masking tests for SA and Impersonated Credentials * chore: Add tests for masking sensitive tokens * chore: Remove secure logging messaging * chore: remove sensitive key mask redundant logic * chore: Add javadocs for the LoggingUtil methods * chore: Remove last reference to secure logging * fix: resolve NPE and ClassCastException preventing proper payload logging * chore: Fix failing test
1 parent 6080fb1 commit 3e4ccb7

16 files changed

Lines changed: 315 additions & 43 deletions

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,6 @@
5151
import com.google.common.base.Joiner;
5252
import com.google.common.base.MoreObjects.ToStringHelper;
5353
import com.google.common.collect.ImmutableList;
54-
import com.google.common.collect.ImmutableMap;
5554
import com.google.common.collect.ImmutableSet;
5655
import com.google.errorprone.annotations.CanIgnoreReturnValue;
5756
import java.io.BufferedReader;
@@ -435,11 +434,9 @@ public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.O
435434
}
436435
String rawToken = response.parseAsString();
437436

438-
LoggingUtils.log(
439-
LOGGER_PROVIDER,
440-
Level.FINE,
441-
ImmutableMap.of("idToken", rawToken),
442-
"Response Payload for ID token");
437+
GenericData idTokenData = new GenericData();
438+
idTokenData.set("id_token", rawToken);
439+
LoggingUtils.logResponsePayload(idTokenData, LOGGER_PROVIDER, "Response Payload for ID token");
443440
return IdToken.create(rawToken);
444441
}
445442

@@ -448,6 +445,9 @@ private HttpResponse getMetadataResponse(
448445
GenericUrl genericUrl = new GenericUrl(url);
449446
HttpRequest request =
450447
transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
448+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
449+
// Client Library Debug Logging via LoggingUtils is used instead where appropriate.
450+
request.setLoggingEnabled(false);
451451
JsonObjectParser parser = new JsonObjectParser(OAuth2Utils.JSON_FACTORY);
452452
request.setParser(parser);
453453
request.getHeaders().set(METADATA_FLAVOR, GOOGLE);
@@ -461,17 +461,17 @@ private HttpResponse getMetadataResponse(
461461
request.setThrowExceptionOnExecuteError(false);
462462
HttpResponse response;
463463
try {
464-
String requestMessage;
465-
String responseMessage;
464+
String requestMessage = null;
465+
String responseMessage = null;
466466
if (requestType.equals(RequestType.ID_TOKEN_REQUEST)) {
467467
requestMessage = "Sending request to get ID token";
468468
responseMessage = "Received response for ID token request";
469469
} else if (requestType.equals(RequestType.ACCESS_TOKEN_REQUEST)) {
470470
requestMessage = "Sending request to refresh access token";
471471
responseMessage = "Received response for refresh access token";
472472
} else {
473-
// TODO: this includes get universe domain and get default sa.
474-
// refactor for more clear logging message.
473+
// TODO: this includes get universe domain and get default sa. Refactor for more clear
474+
// logging message.
475475
requestMessage = "Sending request for universe domain/default service account";
476476
responseMessage = "Received response for universe domain/default service account";
477477
}
@@ -571,6 +571,9 @@ private static boolean pingComputeEngineMetadata(
571571
try {
572572
HttpRequest request =
573573
transportFactory.create().createRequestFactory().buildGetRequest(tokenUrl);
574+
// Disable automatic logging by google-http-java-client. This is a ping request
575+
// and does not need to be logged by LoggingUtils.
576+
request.setLoggingEnabled(false);
574577
request.setConnectTimeout(COMPUTE_PING_CONNECTION_TIMEOUT_MS);
575578
request.getHeaders().set(METADATA_FLAVOR, GOOGLE);
576579
MetricsUtils.setMetricsHeader(

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@
7575
* </pre>
7676
*/
7777
public class ExternalAccountAuthorizedUserCredentials extends GoogleCredentials {
78+
private static final LoggerProvider LOGGER_PROVIDER =
79+
LoggerProvider.forClazz(ExternalAccountAuthorizedUserCredentials.class);
7880

7981
private static final String PARSE_ERROR_PREFIX = "Error parsing token refresh response. ";
8082

@@ -191,13 +193,19 @@ public AccessToken refreshAccessToken() throws IOException {
191193
HttpResponse response;
192194
try {
193195
HttpRequest httpRequest = buildRefreshRequest();
196+
LoggingUtils.logRequest(
197+
httpRequest, LOGGER_PROVIDER, "Sending request to refresh access token");
194198
response = httpRequest.execute();
199+
LoggingUtils.logResponse(
200+
response, LOGGER_PROVIDER, "Received response for refresh access token");
195201
} catch (HttpResponseException e) {
196202
throw OAuthException.createFromHttpResponseException(e);
197203
}
198204

199205
// Parse response.
200206
GenericData responseData = response.parseAs(GenericData.class);
207+
LoggingUtils.logResponsePayload(
208+
responseData, LOGGER_PROVIDER, "Response payload for refresh access token");
201209
response.disconnect();
202210

203211
// Required fields.
@@ -379,6 +387,9 @@ private HttpRequest buildRefreshRequest() throws IOException {
379387
.create()
380388
.createRequestFactory()
381389
.buildPostRequest(new GenericUrl(tokenUrl), new UrlEncodedContent(tokenRequest));
390+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
391+
// Client Library Debug Logging via LoggingUtils is used instead.
392+
request.setLoggingEnabled(false);
382393

383394
request.setParser(new JsonObjectParser(JSON_FACTORY));
384395

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@
6565
import java.util.Objects;
6666

6767
public class GdchCredentials extends GoogleCredentials {
68+
private static final LoggerProvider LOGGER_PROVIDER =
69+
LoggerProvider.forClazz(GdchCredentials.class);
6870
static final String SUPPORTED_FORMAT_VERSION = "1";
6971
private static final String PARSE_ERROR_PREFIX = "Error parsing token refresh response. ";
7072
private static final int DEFAULT_LIFETIME_IN_SECONDS = 3600;
@@ -260,14 +262,20 @@ public AccessToken refreshAccessToken() throws IOException {
260262

261263
HttpRequestFactory requestFactory = transportFactory.create().createRequestFactory();
262264
HttpRequest request = requestFactory.buildPostRequest(new GenericUrl(tokenServerUri), content);
265+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
266+
// Client Library Debug Logging via LoggingUtils is used instead.
267+
request.setLoggingEnabled(false);
263268

264269
request.setParser(new JsonObjectParser(jsonFactory));
265270

266271
HttpResponse response;
267272
String errorTemplate = "Error getting access token for GDCH service account: %s, iss: %s";
268273

269274
try {
275+
LoggingUtils.logRequest(request, LOGGER_PROVIDER, "Sending request to get GDCH access token");
270276
response = request.execute();
277+
LoggingUtils.logResponse(
278+
response, LOGGER_PROVIDER, "Received response for GDCH access token");
271279
} catch (HttpResponseException re) {
272280
String message = String.format(errorTemplate, re.getMessage(), getServiceIdentityName());
273281
throw GoogleAuthException.createWithTokenEndpointResponseException(re, message);
@@ -277,6 +285,8 @@ public AccessToken refreshAccessToken() throws IOException {
277285
}
278286

279287
GenericData responseData = response.parseAs(GenericData.class);
288+
LoggingUtils.logResponsePayload(
289+
responseData, LOGGER_PROVIDER, "Response payload for GDCH access token");
280290
String accessToken =
281291
OAuth2Utils.validateString(responseData, "access_token", PARSE_ERROR_PREFIX);
282292
int expiresInSeconds =

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IamUtils.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,10 @@ private static String getSignature(
135135

136136
HttpRequest request = factory.buildPostRequest(genericUrl, signContent);
137137

138+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
139+
// Client Library Debug Logging via LoggingUtils is used instead.
140+
request.setLoggingEnabled(false);
141+
138142
JsonObjectParser parser = new JsonObjectParser(OAuth2Utils.JSON_FACTORY);
139143
request.setParser(parser);
140144
request.setThrowExceptionOnExecuteError(false);
@@ -232,6 +236,10 @@ static IdToken getIdToken(
232236
HttpRequest request =
233237
transport.createRequestFactory(adapter).buildPostRequest(genericUrl, idTokenContent);
234238

239+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
240+
// Client Library Debug Logging via LoggingUtils is used instead.
241+
request.setLoggingEnabled(false);
242+
235243
JsonObjectParser parser = new JsonObjectParser(OAuth2Utils.JSON_FACTORY);
236244
request.setParser(parser);
237245
request.setThrowExceptionOnExecuteError(false);

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -628,6 +628,9 @@ public AccessToken refreshAccessToken() throws IOException {
628628

629629
HttpContent requestContent = new JsonHttpContent(parser.getJsonFactory(), body);
630630
HttpRequest request = requestFactory.buildPostRequest(url, requestContent);
631+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
632+
// Client Library Debug Logging via LoggingUtils is used instead.
633+
request.setLoggingEnabled(false);
631634
request.setConnectTimeout(connectTimeout);
632635
request.setReadTimeout(readTimeout);
633636
adapter.initialize(request);

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/InternalAwsSecurityCredentialsSupplier.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,10 @@ private String retrieveResource(
205205
HttpRequest request =
206206
requestFactory.buildRequest(requestMethod, new GenericUrl(url), content);
207207

208+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive
209+
// metadata responses.
210+
request.setLoggingEnabled(false);
211+
208212
HttpHeaders requestHeaders = request.getHeaders();
209213
for (Map.Entry<String, Object> header : headers.entrySet()) {
210214
requestHeaders.set(header.getKey(), header.getValue());

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/LoggingUtils.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,11 @@ static void logResponsePayload(
7676
}
7777
}
7878

79-
// generic log method to use when not logging standard request, response and payload
79+
/**
80+
* Generic log method to use when not logging standard request, response and payload.
81+
*
82+
* <p>Note: This does not mask the data. Log carefully if the data contains sensitive tokens.
83+
*/
8084
static void log(
8185
LoggerProvider loggerProvider, Level level, Map<String, Object> contextMap, String message) {
8286
if (loggingEnabled) {

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SecureSessionAgent.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,9 @@ private SecureSessionAgentConfig getSecureSessionAgentConfigFromMDS() {
149149
GenericUrl genericUrl = new GenericUrl(MDS_MTLS_ENDPOINT);
150150
try {
151151
request = transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
152+
// Disable automatic logging by google-http-java-client.
153+
// This is a configuration request to MDS and does not contain sensitive token payloads.
154+
request.setLoggingEnabled(false);
152155
} catch (IOException ignore) {
153156
/*
154157
* Return empty addresses in {@link SecureSessionAgentConfig} if error building the GET request.

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -534,6 +534,9 @@ public AccessToken refreshAccessToken() throws IOException {
534534

535535
HttpRequestFactory requestFactory = transportFactory.create().createRequestFactory();
536536
HttpRequest request = requestFactory.buildPostRequest(new GenericUrl(tokenServerUri), content);
537+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
538+
// Client Library Debug Logging via LoggingUtils is used instead.
539+
request.setLoggingEnabled(false);
537540

538541
MetricsUtils.setMetricsHeader(
539542
request,
@@ -693,6 +696,9 @@ private HttpRequest buildIdTokenRequest(
693696
JsonFactory jsonFactory = OAuth2Utils.JSON_FACTORY;
694697
HttpRequestFactory requestFactory = transportFactory.create().createRequestFactory();
695698
HttpRequest request = requestFactory.buildPostRequest(new GenericUrl(uri), content);
699+
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
700+
// Client Library Debug Logging via LoggingUtils is used instead.
701+
request.setLoggingEnabled(false);
696702
request.setParser(new JsonObjectParser(jsonFactory));
697703
return request;
698704
}

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/Slf4jLoggingHelpers.java‎

Lines changed: 49 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,12 @@
3131

3232
package com.google.auth.oauth2;
3333

34+
import com.google.api.client.http.HttpContent;
3435
import com.google.api.client.http.HttpRequest;
3536
import com.google.api.client.http.HttpResponse;
3637
import com.google.api.client.http.UrlEncodedContent;
3738
import com.google.api.client.http.json.JsonHttpContent;
39+
import com.google.api.client.util.Data;
3840
import com.google.api.client.util.GenericData;
3941
import com.google.gson.Gson;
4042
import java.nio.charset.StandardCharsets;
@@ -59,10 +61,15 @@ class Slf4jLoggingHelpers {
5961
"token",
6062
"assertion",
6163
"access_token",
64+
// IAM Credentials getAccessTokenCall returns `accessToken` and not `access_token`:
65+
// https://docs.cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken
66+
"accessToken",
6267
"client_secret",
6368
"refresh_token",
6469
"signedBlob",
65-
"authorization"));
70+
"authorization",
71+
"subject_token",
72+
"id_token"));
6673
}
6774

6875
static void logRequest(HttpRequest request, LoggerProvider loggerProvider, String message) {
@@ -73,35 +80,24 @@ static void logRequest(HttpRequest request, LoggerProvider loggerProvider, Strin
7380
loggingDataMap.put("request.method", request.getRequestMethod());
7481
loggingDataMap.put("request.url", request.getUrl().toString());
7582

76-
Map<String, Object> headers = new HashMap<>();
77-
request
78-
.getHeaders()
79-
.forEach(
80-
(key, val) -> {
81-
if (SENSITIVE_KEYS.contains(key)) {
82-
String hashedVal = calculateSHA256Hash(String.valueOf(val));
83-
headers.put(key, hashedVal);
84-
} else {
85-
headers.put(key, val);
86-
}
87-
});
83+
Map<String, Object> headers = parseGenericData(request.getHeaders());
8884
loggingDataMap.put("request.headers", gson.toJson(headers));
8985

9086
if (request.getContent() != null && logger.isDebugEnabled()) {
91-
// are payload always GenericData? If so, can parse and store in json
92-
if (request.getContent() instanceof UrlEncodedContent) {
93-
// this is parsed to GenericData because that is how it is constructed.
94-
GenericData data = (GenericData) ((UrlEncodedContent) request.getContent()).getData();
87+
Map<String, Object> data = null;
88+
HttpContent content = request.getContent();
89+
if (content instanceof UrlEncodedContent) {
90+
data = Data.mapOf(((UrlEncodedContent) content).getData());
91+
} else if (content instanceof JsonHttpContent) {
92+
data = Data.mapOf(((JsonHttpContent) content).getData());
93+
}
94+
if (data != null) {
95+
// this call will mask the sensitive keys in the payload
9596
Map<String, Object> contextMap = parseGenericData(data);
9697
loggingDataMap.put("request.payload", gson.toJson(contextMap));
97-
} else if (request.getContent() instanceof JsonHttpContent) {
98-
String jsonData = gson.toJson(((JsonHttpContent) request.getContent()).getData());
99-
loggingDataMap.put("request.payload", jsonData);
10098
}
101-
10299
Slf4jUtils.log(logger, org.slf4j.event.Level.DEBUG, loggingDataMap, message);
103100
} else {
104-
105101
Slf4jUtils.log(logger, org.slf4j.event.Level.INFO, loggingDataMap, message);
106102
}
107103
}
@@ -132,7 +128,6 @@ static void logResponse(HttpResponse response, LoggerProvider loggerProvider, St
132128
static void logResponsePayload(
133129
GenericData genericData, LoggerProvider loggerProvider, String message) {
134130
try {
135-
136131
Logger logger = loggerProvider.getLogger();
137132
if (logger.isDebugEnabled()) {
138133
Map<String, Object> contextMap = parseGenericData(genericData);
@@ -168,22 +163,43 @@ static org.slf4j.event.Level matchUtilLevelToSLF4JLevel(Level level) {
168163
}
169164
}
170165

171-
private static Map<String, Object> parseGenericData(GenericData genericData) {
166+
/**
167+
* Parses standard {@link GenericData} key-value payloads into a loggable format.
168+
*
169+
* <p>Any key that exists within the {@code SENSITIVE_KEYS} set (e.g. access tokens, refresh
170+
* tokens) will have its corresponding value masked via a SHA-256 hash. This guarantees that
171+
* sensitive secrets are never logged in plain text while keeping the hash signature consistent
172+
* for debugging purposes. Non-sensitive keys are passed through directly as strings.
173+
*
174+
* @param data the payload data to parse
175+
* @return a map containing the safely parsed and optionally masked context
176+
*/
177+
@SuppressWarnings("unchecked")
178+
private static Map<String, Object> parseGenericData(Map<String, Object> data) {
172179
Map<String, Object> contextMap = new HashMap<>();
173-
genericData.forEach(
180+
data.forEach(
174181
(key, val) -> {
175182
if (SENSITIVE_KEYS.contains(key)) {
176183
String secretString = String.valueOf(val);
177184
String hashedVal = calculateSHA256Hash(secretString);
178185
contextMap.put(key, hashedVal);
179186
} else {
180-
contextMap.put(key, val.toString());
187+
contextMap.put(key, String.valueOf(val));
181188
}
182189
});
183190
return contextMap;
184191
}
185192

186-
// calculate SHA256Hash so we do not print secrets directly to log
193+
/**
194+
* Applies a SHA-256 one-way cryptographic hash to securely mask sensitive data.
195+
*
196+
* <p>Logging must be completely fail-safe. If the SHA-256 algorithm is unsupported on the system,
197+
* this will gracefully downgrade to a static error fallback message to ensure the underlying auth
198+
* request does not crash.
199+
*
200+
* @param data the sensitive secret string to hash
201+
* @return the resulting 64-character hex string representing the hashed secret
202+
*/
187203
private static String calculateSHA256Hash(String data) {
188204
try {
189205
MessageDigest digest = MessageDigest.getInstance("SHA-256");
@@ -195,6 +211,12 @@ private static String calculateSHA256Hash(String data) {
195211
}
196212
}
197213

214+
/**
215+
* Converts a raw cryptographic byte array digest into a padded, readable hexadecimal String.
216+
*
217+
* @param hash the digested byte array
218+
* @return a formatted hexadecimal string representation
219+
*/
198220
private static String bytesToHex(byte[] hash) {
199221
StringBuilder hexString = new StringBuilder(2 * hash.length);
200222
for (byte b : hash) {

0 commit comments

Comments
 (0)