Fix: Security tokens are logged verbatim (DataBiosphere/azul-private#377) by hannes-ucsc · Pull Request #8085 · DataBiosphere/azul

hannes-ucsc · 2026-06-08T16:12:26Z

Linked issues: DataBiosphere/azul-private#377

Checklist

Author

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all linked issues}
This PR partially resolves each of the linked issues _{or does not have the partial label}

Author (reindex)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}

Author (mirror)

This PR is labeled mirror:dev _{or the changes introduced by it will not require mirroring of dev}
This PR is labeled mirror:anvildev _{or the changes introduced by it will not require mirroring of anvildev}
This PR is labeled mirror:anvilprod _{or the changes introduced by it will not require mirroring of anvilprod}
This PR is labeled mirror:prod _{or the changes introduced by it will not require mirroring of prod}
This PR is labeled mirror:partial and its description documents the specific mirroring procedure for dev, anvildev, anvilprod and prod _{or requires a full mirroring or carries none of the labels mirror:dev, mirror:anvildev, mirror:anvilprod and mirror:prod}

Author (API changes)

This PR and its linked issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any linked issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues linked to this PR}

Author (before every review)

Rebased PR branch on develop, squashed fixups from prior reviews
Ran make requirements_update _{or this PR does not modify Dockerfile, environment, requirements*.txt, common.mk, Makefile or environment.boot}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}
PR is awaiting requested review from a peer
Status of PR is Review requested
PR is assigned to only the peer and the author

Peer reviewer (after approval)

Note that after requesting changes, the PR must be assigned to only the author.

Actually approved the PR
PR is not a draft
PR is awaiting requested review from system administrator
Status of PR is Review requested
PR is assigned to only the system administrator and the author

System administrator (after approval)

Actually approved the PR
Labeled linked issues as demo or no demo
Commented on linked issues about demo expectations _{or all linked issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Status of PR is Approved
PR is assigned to only the operator and the author

Operator

Checked reindex:… labels and r commit title tag
Checked mirror:… labels
Checked that demo expectations are clear _{or all linked issues are labeled no demo}
Squashed PR branch and rebased onto develop
Sanity-checked history
Pushed PR branch to GitHub

Operator (deploy `.shared` and `.gitlab` components)

Ran _select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply _{or this PR is not labeled deploy:gitlab}
Ran _select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
Ran _select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply _{or this PR is not labeled deploy:gitlab}
Checked the items in the next section _{or this PR is labeled deploy:gitlab}
PR is assigned to only the system administrator and the author _{or this PR is not labeled deploy:gitlab}

System administrator (post-deploy of `.gitlab` component)

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator and the author

Operator (deploy runner image)

Ran _select dev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}
Ran _select anvildev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}

Operator (sandbox build)

Operator (merge the branch)

All status checks passed and the PR is mergeable
The title of the merge commit starts with the title of this PR
Added PR # reference to merge commit title
Collected commit title tags in merge commit title _{but only included p if the PR is also labeled partial}
Pushed merge commit to GitHub
Status of PR is Merged lower
Status of blocked issues is Triage _{or no issues are blocked on the linked issues}

Operator (main build)

Operator (reindex)

Operator (mirroring)

Started mirroring in dev _{or this PR is not labelled mirror:dev}
Started mirroring in anvildev _{or this PR is not labelled mirror:anvildev}
Checked for, triaged and possibly requeued messages in mirror fail queue in dev _{or this PR is not labelled mirror:dev}
Checked for, triaged and possibly requeued messages in mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}
Emptied mirror fail queue in dev _{or this PR is not labelled mirror:dev}
Emptied mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}

Operator

Propagated the upgrade and API labels to the next promotion PRs _{or this PR carries neither of these labels}
Propagated the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

coveralls · 2026-06-08T16:26:55Z

coverage: 84.791% (-0.008%) from 84.799% — issues/hannes-ucsc/377-redact into develop

codecov · 2026-06-08T17:37:50Z

Codecov Report

❌ Patch coverage is 90.00000% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.71%. Comparing base (7c48a44) to head (a5572b9).

Files with missing lines	Patch %	Lines
src/azul/oauth2.py	16.66%	5 Missing ⚠️
src/azul/auth.py	83.33%	2 Missing ⚠️
test/integration_test.py	0.00%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #8085      +/-   ##
===========================================
- Coverage    84.72%   84.71%   -0.01%     
===========================================
  Files          165      165              
  Lines        24254    24294      +40     
===========================================
+ Hits         20548    20580      +32     
- Misses        3706     3714       +8

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

hannes-ucsc · 2026-06-08T18:23:36Z

(Posted by Claude Code)

Security Design Review: Secret Redaction in Logs (#377)

Objective

Prevent APATs (JWTs), OAuth 2.0 access tokens, refresh tokens, and authorization codes from appearing unredacted in CloudWatch and GitLab CI logs.

Threat Model

Secrets logged verbatim can be exfiltrated by anyone with read access to CloudWatch log groups or GitLab CI job logs, enabling token replay attacks.

Changes Reviewed

13 files changed across the branch (14 commits, excluding CI-only changes).

Findings

1. Redaction coverage — ADEQUATE

All identified log emission sites are now covered:

Request headers (chalice.py — _LogJSONEncoder)
Request/response headers (http.py — _redact_headers / _redact_header)
Request/response bodies (logging.py — http_body_log_message)
HTTP client URLs (http.py — LoggingHttpClient.urlopen)
Authentication objects (auth.py — __str__ vs __repr__ convention)
User service log statements (user_service.py — 8 call sites switched from %r/.redacted() to %s)
Integration test curl command (integration_test.py)
Boto3/DynamoDB request/response bodies (deployment.py — via http_body_log_message)

2. Regex pattern specificity — ACCEPTABLE with caveats

JWTs (ey[IJ]...): Strong prefix, low false-positive risk.
Access tokens (ya29.): Strong prefix, low false-positive risk.
Refresh tokens (1// + 2 digits + exactly 98 base64url chars): Tight constraint, low false-positive risk.
Authorization codes (4/ + 1 digit + exactly 70 base64url chars): Tight constraint. The initial unbounded 4/ pattern caused a false positive (4/site-packages), correctly caught and fixed.
Risk: These patterns are based on observed token formats, not documented specifications. The assert_redactable assertions at validation sites mitigate this — if Google changes token formats, assertions will fire before unredacted tokens reach logs.

3. Fallback in _redact_header — SECURE

When redact(value, fullmatch=True) doesn't match on an authorization header (unrecognized auth scheme), the entire value is replaced with 'REDACTED'. This is the correct fail-closed behavior. Non-authorization headers that don't match are passed through unchanged.

4. fullmatch=True optimization — CORRECT

Used at sites where the string is known to be an isolated token (header values, redact_json values, BearerTokenAuthentication.__str__). This avoids unnecessary scanning and cannot miss secrets since the entire string is the token.

5. OpenSearch redact=False — ACCEPTABLE

OpenSearch request/response bodies don't contain user secrets (they contain index data). Skipping redaction avoids a performance penalty on potentially large bodies. This is a conscious, documented trade-off.

6. repr() vs str() convention on Authentication — SECURE

str() produces redacted output (safe for logs), repr() produces unredacted output (for debugging). The __str__ method is abstract on Authentication, forcing all subclasses to implement it. All log statements use %s (which calls str()).

7. No secret leakage in assertion messages — VERIFIED

assert_redactable does not include the secret value in its error message.

Residual Risks

URL signatures: The FIXME comments mentioned "URL signatures" alongside access tokens in HTTP client URLs. The redact() regex won't match URL signatures (e.g., SAS tokens or signed URLs) unless they happen to contain a recognized token pattern. This is a known gap.
boto3.resources.action logger: The LambdaLogFilter.truncate path (for large S3 upload parts at debug level 2) does not apply redaction. This is acceptable since S3 upload bodies are binary data, not tokens.

Verdict

The changes are sound. The defense-in-depth approach (regex-based scanning at log sites + assert_redactable at validation sites + fail-closed fallback for unknown auth schemes) provides strong protection against the identified threat. The residual risks are minor and clearly scoped.

hannes-ucsc · 2026-06-09T01:13:13Z

Residual Risks

URL signatures: The FIXME comments mentioned "URL signatures" alongside access tokens in HTTP client URLs. The redact() regex won't match URL signatures (e.g., SAS tokens or signed URLs) unless they happen to contain a recognized token pattern. This is a known gap.

I decided to not redact signed URLs for now.

Post-poned to https://github.com/DataBiosphere/azul-private/issues/390

hannes-ucsc · 2026-06-09T05:18:08Z

hannes-ucsc · 2026-06-10T00:42:44Z

Clearing the approved queue in preparation for the higher-priority #7794.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…vate#377) Add FIXME comments to all log statements identified as logging unredacted APATs, OAuth access/refresh tokens, authorization codes, and URL signatures. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The decorator was added in 964c6a2 for JSON serialization support (to_json/from_json using attr.asdict) but that was later removed in 17af058. Authentication has never had any fields of its own. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…azul-private#377) Add __str__ to Authentication hierarchy: str() produces a redacted representation safe for logging, while repr() remains unredacted. Replace .redacted() calls with %s formatting and update the test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace the ad-hoc prefix checks with a compiled regex. Captured groups are redacted while the rest of the match is preserved. The default mode scans for secrets anywhere in the string; fullmatch=True requires the entire string to be a secret. The regex accepts an optional case-insensitive 'Bearer ' prefix, simplifying _LoggingConnectionPool._redact. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…re/azul-private#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…vate#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> fixup! Redact secrets in HTTP body log messages (DataBiosphere/azul-private#377)

…te#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…azul-private#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ivate#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ul-private#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…-private#377) Extract _redact_header and _redact_headers functions to apply regex-based redaction to all HTTP headers, with a fail-closed fallback for unrecognized authorization header formats. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dsotirho-ucsc

Pro forma approval

hannes-ucsc self-assigned this Jun 8, 2026

github-advanced-security AI found potential problems Jun 8, 2026

View reviewed changes

Comment thread src/azul/opensearch.py Dismissed

Comment thread src/azul/opensearch.py Dismissed

Comment thread test/integration_test.py Dismissed

hannes-ucsc force-pushed the issues/hannes-ucsc/377-redact branch from a0386c9 to 2d953c7 Compare June 8, 2026 16:23

hannes-ucsc force-pushed the issues/hannes-ucsc/377-redact branch from 2d953c7 to 84e32c9 Compare June 8, 2026 16:30

hannes-ucsc changed the title ~~Security tokens are logged verbatim (DataBiosphere/azul-private#377)~~ Fix: Security tokens are logged verbatim (DataBiosphere/azul-private#377) Jun 8, 2026

hannes-ucsc changed the title ~~Fix: Security tokens are logged verbatim (DataBiosphere/azul-private#377)~~ Security tokens are logged verbatim (DataBiosphere/azul-private#377) Jun 8, 2026

hannes-ucsc assigned nadove-ucsc Jun 9, 2026

nadove-ucsc assigned dsotirho-ucsc and unassigned nadove-ucsc Jun 9, 2026

hannes-ucsc unassigned dsotirho-ucsc Jun 10, 2026

hannes-ucsc force-pushed the issues/hannes-ucsc/377-redact branch from 30e003b to c07155b Compare June 10, 2026 05:35

hannes-ucsc and others added 13 commits June 10, 2026 17:13

Search for issues in both azul and azul-private (#7974)

bfe6f21

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add redaction patterns for refresh tokens and auth codes (DataBiosphe…

66f58b9

…re/azul-private#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Redact secrets in request header log messages (DataBiosphere/azul-pri…

8cb7c70

…vate#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Rename local repr variable to avoid shadowing builtin

0d725e0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Redact secrets in HTTP body log messages (DataBiosphere/azul-private#377

866faf0

) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> fixup! Redact secrets in HTTP body log messages (DataBiosphere/azul-private#377)

Assert that validated tokens are redactable (DataBiosphere/azul-priva…

5226202

…te#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Rename functions

69e7122

Rearrange functions

cb213fc

Skip redaction for OpenSearch request/response bodies (DataBiosphere/…

0cc8d91

…azul-private#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hannes-ucsc and others added 4 commits June 10, 2026 17:13

Redact secrets in HTTP client URL log messages (DataBiosphere/azul-pr…

3d921b5

…ivate#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Redact secrets in manifest curl command log message (DataBiosphere/az…

b8f853e

…ul-private#377) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fix: "Could not verify signature" for Codecov's GH action

ddf17b6

hannes-ucsc force-pushed the issues/hannes-ucsc/377-redact branch from c07155b to a5572b9 Compare June 11, 2026 01:46

hannes-ucsc assigned dsotirho-ucsc Jun 11, 2026

hannes-ucsc added the sandbox [process] Resolution is being verified in sandbox deployment label Jun 11, 2026

dsotirho-ucsc approved these changes Jun 11, 2026

View reviewed changes

dsotirho-ucsc changed the title ~~Security tokens are logged verbatim (DataBiosphere/azul-private#377)~~ Fix: Security tokens are logged verbatim (DataBiosphere/azul-private#377) Jun 11, 2026

dsotirho-ucsc merged commit d22b450 into develop Jun 11, 2026
10 checks passed

This was referenced Jun 11, 2026

Validate APATs offline using outsourced KMS public key #8091

Open

AU-3 CONTENT OF AUDIT RECORDS #5007

Open

dsotirho-ucsc deleted the issues/hannes-ucsc/377-redact branch June 11, 2026 18:13

dsotirho-ucsc unassigned hannes-ucsc and dsotirho-ucsc Jun 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: Security tokens are logged verbatim (DataBiosphere/azul-private#377)#8085

Fix: Security tokens are logged verbatim (DataBiosphere/azul-private#377)#8085
dsotirho-ucsc merged 17 commits into
developfrom
issues/hannes-ucsc/377-redact

hannes-ucsc commented Jun 8, 2026 •

edited by dsotirho-ucsc

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coveralls commented Jun 8, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

hannes-ucsc commented Jun 8, 2026 •

edited

Loading

Uh oh!

hannes-ucsc commented Jun 9, 2026 •

edited

Loading

Residual Risks

Uh oh!

hannes-ucsc commented Jun 9, 2026 •

edited

Loading

Uh oh!

hannes-ucsc commented Jun 10, 2026

Uh oh!

dsotirho-ucsc left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

hannes-ucsc commented Jun 8, 2026 • edited by dsotirho-ucsc Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Author

Author (partiality)

Author (reindex)

Author (mirror)

Author (API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator

Operator (deploy .shared and .gitlab components)

System administrator (post-deploy of .gitlab component)

Operator (deploy runner image)

Operator (sandbox build)

Operator (merge the branch)

Operator (main build)

Operator (reindex)

Operator (mirroring)

Operator

Shorthand for review comments

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coveralls commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

hannes-ucsc commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Objective

Threat Model

Changes Reviewed

Findings

Residual Risks

Verdict

Uh oh!

hannes-ucsc commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Residual Risks

Uh oh!

hannes-ucsc commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security design review

Uh oh!

hannes-ucsc commented Jun 10, 2026

Uh oh!

dsotirho-ucsc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

hannes-ucsc commented Jun 8, 2026 •

edited by dsotirho-ucsc

Loading

Operator (deploy `.shared` and `.gitlab` components)

System administrator (post-deploy of `.gitlab` component)

coveralls commented Jun 8, 2026 •

edited

Loading

codecov Bot commented Jun 8, 2026 •

edited

Loading

hannes-ucsc commented Jun 8, 2026 •

edited

Loading

hannes-ucsc commented Jun 9, 2026 •

edited

Loading

hannes-ucsc commented Jun 9, 2026 •

edited

Loading