Mask certain HTTP headers in the HTTP access log #44475
Conversation
Closes keycloak#43811 Signed-off-by: Martin Bartoš <[email protected]>
| public static final Option<List<String>> HTTP_ACCESS_LOG_MASKED_COOKIES = OptionBuilder.listOptionBuilder("http-access-log-masked-cookies", String.class) | ||
| .category(OptionCategory.HTTP_ACCESS_LOG) | ||
| .description("Set of HTTP Cookie headers whose values must be masked when the 'long' pattern or '%{ALL_REQUEST_HEADERS}' format is enabled with the 'http-access-log-pattern' option.") | ||
| .hidden() // hidden for now as we do not have the full Quarkus support for this yet |
There was a problem hiding this comment.
Does it matter if there's quarkus support whether this is hidden?
Will this ever be set by a user? If so, we could consider making it additive to the default.
There was a problem hiding this comment.
It was rather for purposes to be on a safe side, but yes, it might not be hidden.
It's expected that some additives will be there: #44433
|
Put on hold, as we probably wait for Quarkus to have it included (needs to be discussed with them). This PR can hang in here for cases it's not included in Quarkus in the foreseeable future. |
Makes sense. One more thought - it would be safer to specify what headers / cookies can be shown vs. what should be masked. |
CustomAllRequestHeadersAttributeon our own until Quarkus has the fix included (changes necessary for Keycloak are marked)AuthorizationHTTP header value, such as tokens.