feat: more aggressively truncate logged access_token (#3264)
* partly address #2120 and more aggressively truncate access_token
- leaking half of the access token to the logs seems problematic from
a security point of view
- also noisier than necessary logging
- fixed by truncating to at most first 5 chars (e.g. `ya29.`)
Signed-off-by: Martin Nowak <code@dawg.eu>
* feat: more aggressively truncate logged access_token; add unit test and changelog
Signed-off-by: Jan Larwig <jan@larwig.com>
---------
Signed-off-by: Martin Nowak <code@dawg.eu>
Signed-off-by: Jan Larwig <jan@larwig.com>
Co-authored-by: Jan Larwig <jan@larwig.com>
commitb4eb611c07568934ef87845647718c317a921f57
authordawg <code@dawg.eu>
dateWed 14 Jan 2026, 23:12 (9 months ago)
parentf3dcffe
CHANGELOG.md+1
@@ -11,6 +11,7 @@
1111- [#3197](https://github.com/oauth2-proxy/oauth2-proxy/pull/3197) fix: NewRemoteKeySet is not using DefaultHTTPClient (@rsrdesarrollo / @tuunit)
1212- [#3292](https://github.com/oauth2-proxy/oauth2-proxy/pull/3292) chore(deps): upgrade gomod and bump to golang v1.25.5 (@tuunit)
1313- [#3304](https://github.com/oauth2-proxy/oauth2-proxy/pull/3304) fix: added conditional so default is not always set and env vars are honored fixes 3303 (@pixeldrew)
14+- [#3264](https://github.com/oauth2-proxy/oauth2-proxy/pull/3264) fix: more aggressively truncate logged access_token (@MartinNowak / @tuunit)
1415
1516# V7.13.0
1617
providers/internal_util.go+2−1
@@ -36,7 +36,8 @@ func stripParam(param, endpoint string) string {
3636 }
3737
3838 if val := values.Get(param); val != "" {
39− values.Set(param, val[:(len(val)/2)]+"...")
39+ // Truncate by at least half and allow for a maximum of 5 characters
40+ values.Set(param, val[:min(len(val)/2, 5)]+"...")
4041 u.RawQuery = values.Encode()
4142 return u.String()
4243 }
providers/internal_util_test.go+6
@@ -149,3 +149,9 @@ func TestStripToken(t *testing.T) {
149149 expected := "http://local.test/api/test?access_token=dead...&b=1&c=2"
150150 assert.Equal(t, expected, stripToken(test))
151151}
152+
153+func TestStripLongToken(t *testing.T) {
154+ test := "http://local.test/api/test?access_token=deadbeefwithsupersecret&b=1&c=2"
155+ expected := "http://local.test/api/test?access_token=deadb...&b=1&c=2"
156+ assert.Equal(t, expected, stripToken(test))
157+}