Kibana logger exposes secure headers in a debug mode

[pepl]

Hi,

We use DEBUG=hana to print executed SQL statements in our pod.

After switching to Kibana logs we found that logger started printing all request headers including some secrets like we use internally 'X-Abcdef-Authentication' for example.

In kibana.js I found a following code:

I think it makes sense here to introduce kind of configuration when we can exclude specific headers from being printed out.

Same for cookie, it's even worse.. contains too much data to show.. It would be nice to hide it too.

What do you think?

Thanks!

[pepl]

steffen.weinstock could you please help to tag a right person for this issue? Thank you!

[pepl]

vobu could you please advise who can look into this issue? thanks!

[gregorw]

Hi Petr,

don't think that Volker can help here. Would hope that someone form the SAP CAP Team takes care of this issue.

Best Regards
Gregor

[vobu]

Hi Petr, yeah, as Gregor has already said, nothing I can do here - other than comment in the hopes that the CAP folks are becoming aware of the issue.

Sorry, V.

[vansyckel]

Hi Petr,

We added configurability in @sap/cds@7.5.0 (to be released in Dec.).

Best,
Sebastian

[vansyckel]

Hi Petr,

Since cds^6.3.0 all authorization and cookie headers are masked. Is that sufficient for you?

Best,
Sebastian

[pepl]

Hi Sebastian, correct, masking auth headers is great. However, there can be more different header names per customer. Like may be Gitlab-Token or something else. That's why i thought giving the option to configure the output ( regex for example ) could be enough probably. Anyway thanks for update. I'll check this part