Description
The session_id from the OAuth2 callback query parameter is logged directly to console
via console.print(f"Handling 3LO callback for workload_user_id={user_id} | session_id={session_id}").
In OAuth2 flows, session identifiers can be sensitive authentication state that may be
correlated with tokens or authorization grants. Console output may be captured in CI/CD logs,
shared terminal sessions, log aggregation services, or crash reports, leading to unintended
exposure of authentication session data.
Severity: medium
File: src/bedrock_agentcore_starter_toolkit/operations/identity/oauth2_callback_server.py
Expected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.
Description
The
session_idfrom the OAuth2 callback query parameter is logged directly to consolevia
console.print(f"Handling 3LO callback for workload_user_id={user_id} | session_id={session_id}").In OAuth2 flows, session identifiers can be sensitive authentication state that may be
correlated with tokens or authorization grants. Console output may be captured in CI/CD logs,
shared terminal sessions, log aggregation services, or crash reports, leading to unintended
exposure of authentication session data.
Severity:
mediumFile:
src/bedrock_agentcore_starter_toolkit/operations/identity/oauth2_callback_server.pyExpected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.