[TT-431] Authorization token should not be recorded in detailed logs

cli/linter/schema.json

@@ -509,6 +509,9 @@
         "enable_detailed_recording": {
           "type": "boolean"
         },
+        "allow_unsafe_detailed_logs": {
+          "type": "boolean"
+        },
         "purge_interval": {
           "type": "number"
         },

config/config.go

@@ -278,6 +278,10 @@ type AnalyticsConfigConfig struct {
 	// This setting can be overridden with an organization flag, enabed at an API level, or on individual Key level.
 	EnableDetailedRecording bool `json:"enable_detailed_recording"`
 
+	// AllowUnsafeDetailedLogs controls whether sensitive headers (Authorization) are obfuscated when detailed recording is enabled.
+	// Setting this to true restores the legacy behavior where raw requests are captured as-is, which may expose sensitive tokens in plain text.
+	AllowUnsafeDetailedLogs bool `json:"allow_unsafe_detailed_logs"`
+
 	// Tyk can store GeoIP information based on MaxMind DB’s to enable GeoIP tracking on inbound request analytics. Set this value to `true` and assign a DB using the `geo_ip_db_path` setting.
 	EnableGeoIP bool `json:"enable_geo_ip"`
 

gateway/analytics_helper.go

@@ -0,0 +1,95 @@
+package gateway
+
+import (
+	"bytes"
+	"encoding/base64"
+	"net/http"
+
+	"github.com/TykTechnologies/tyk/apidef"
+	"github.com/TykTechnologies/tyk/ctx"
+	"github.com/TykTechnologies/tyk/header"
+	"github.com/TykTechnologies/tyk/internal/httputil"
+	"github.com/TykTechnologies/tyk/user"
+)
+
+const obfuscationToken = "***"
+
+func getRawRequest(r *http.Request, spec *APISpec) string {
+	var wireFormatReq bytes.Buffer
+
+	var originalHeaders http.Header
+	if !spec.GlobalConfig.AnalyticsConfig.AllowUnsafeDetailedLogs {
+		originalHeaders = obfuscateAuthorizationHeaders(r, spec)
+		defer func() {
+			r.Header = originalHeaders
+		}()
+	}
+
+	r.Write(&wireFormatReq)
+	rawRequest := base64.StdEncoding.EncodeToString(wireFormatReq.Bytes())
+
+	return rawRequest
+}
+
+func obfuscateAuthorizationHeaders(r *http.Request, spec *APISpec) http.Header {
+	original := r.Header.Clone()
+	authNames := make([]string, 0)
+
+	addAuthHeader := func(config apidef.AuthConfig) {
+		if config.DisableHeader {
+			return
+		}
+
+		name := config.AuthHeaderName
+		if name == "" {
+			name = header.Authorization
+		}
+		authNames = append(authNames, http.CanonicalHeaderKey(name))
+	}
+
+	addAuthHeader(spec.Auth)
+
+	for _, authConfig := range spec.AuthConfigs {
+		addAuthHeader(authConfig)
+	}
+
+	for _, authName := range authNames {
+		if _, ok := r.Header[authName]; ok {
+			r.Header.Set(authName, obfuscationToken)
+		}
+	}
+
+	return original
+}
+
+func recordDetail(r *http.Request, spec *APISpec) bool {
+	// when streaming in grpc, we do not record the request
+	if httputil.IsStreamingRequest(r) {
+		return false
+	}
+
+	return recordDetailUnsafe(r, spec)
+}
+
+func recordDetailUnsafe(r *http.Request, spec *APISpec) bool {
+	if spec.EnableDetailedRecording {
+		return true
+	}
+
+	if session := ctxGetSession(r); session != nil {
+		if session.EnableDetailedRecording || session.EnableDetailRecording { // nolint:staticcheck // Deprecated DetailRecording
+			return true
+		}
+	}
+
+	// decide based on org session.
+	if spec.GlobalConfig.EnforceOrgDataDetailLogging {
+		session, ok := r.Context().Value(ctx.OrgSessionContext).(*user.SessionState)
+		if ok && session != nil {
+			return session.EnableDetailedRecording || session.EnableDetailRecording // nolint:staticcheck // Deprecated DetailRecording
+		}
+	}
+
+	// no org session found, use global config
+	return spec.GraphQL.Enabled || spec.GlobalConfig.AnalyticsConfig.EnableDetailedRecording
+}