search

netzbegruenung / keycloak-mfa-plugins

Keycloak Authentication Provider implementation to get a 2nd-factor authentication with a OTP/code/token send via SMS
Apache License 2.0
42 stars 9 forks source link

SMS Logging #81

Closed patmoshosting closed 2 weeks ago

patmoshosting commented 1 month ago

There are two issues with how SMS messages from Twilio are logged:

  1. The plugin only considers status code 200 as successful, while Twilio uses status code 201 to indicate a success.
  2. The plugin logs the entire response body after a message is sent. Twilio includes the contents of the message in the response body, which means anyone who has access to the log files also has access to every 2FA code that is sent via SMS.
melegiul commented 2 weeks ago

Thanks a lot for your report. All response code with 2xx will now be considered successful. While the previous implementation should not make any harm, as the response code only decides about log level (info or error).

I also added a config option to hide the response body in the logs. image