Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Full token payload being logged when error occurs #259

Open
yearofthedan opened this issue Dec 31, 2020 · 2 comments
Open

Full token payload being logged when error occurs #259

yearofthedan opened this issue Dec 31, 2020 · 2 comments

Comments

@yearofthedan
Copy link

yearofthedan commented Dec 31, 2020

Describe the bug
When an error occurs during processing the login token response, the whole token object is logged. This may lead to a consumer accidentally logging user credentials and storing in centralised logging.

`Gotrue-js: Failed to parse tokenResponse claims: ${JSON.stringify(tokenResponse)}`,

Specifically I ran into this while trying to use the library in a Node app (which the library doesn't support currently), but any internal error will trigger this.

To Reproduce
This node script will show the logging. Note that this is using node-fetch so as to be able to run the fetch and get to the decoding.

const GoTrue = require('gotrue-js').default;
const fetch = require('node-fetch');
globalThis.fetch = fetch;
auth.login(userName, password);
  1. Run script
  2. See logging

Alternatively this could also be triggered on the browser side from a malformed set of returned token claims.

Expected behavior
There should be a meaningful message, but no logging of the token itself.

@yearofthedan
Copy link
Author

This behaviour was introduced by #17. It looks like the logging was to help troubleshoot an issue, so may no longer be required.

@AndyTurnerNetlify
Copy link

@dustincrogers @merlyn-at-netlify - tagging Owner: AppSec here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants