API tokens are written to logs - Githubissues

uktrade / fargatespawner

Spawns JupyterHub single user servers in Docker containers running in AWS Fargate

MIT License

47 stars 21 forks source link

API tokens are written to logs #20

Open reallyrandom opened 3 years ago

reallyrandom commented 3 years ago

The following log line records API keys in plain text

[D 2021-01-13 21:16:04.593 JupyterHub fargatespawner:351] Request response ...

JUPYTERHUB_API_TOKEN JPY_API_TOKEN

I believe this is the line writing the log: https://github.com/uktrade/fargatespawner/blob/master/fargatespawner/fargatespawner.py#L203

run_response = await _run_task(self.log, self._aws_endpoint(), self.get_run_task_args(self))