Redact sensitive api creds before logging message in websocket api

homeassistant/components/websocket_api/connection.py

@@ -13,6 +13,7 @@
 from homeassistant.core import Context, HomeAssistant, callback
 from homeassistant.exceptions import HomeAssistantError, Unauthorized
 from homeassistant.helpers.http import current_request
+from homeassistant.helpers.redact import async_redact_data
 from homeassistant.util.json import JsonValueType
 
 from . import const, messages
@@ -32,6 +33,15 @@
     "current_connection", default=None
 )
 
+REDACT_KEYS = {
+    "access_token",
+    "password",
+    "api_password",
+    "refresh_token",
+    "token",
+    "auth_token",
+}
+
 type MessageHandler = Callable[[HomeAssistant, ActiveConnection, dict[str, Any]], None]
 type BinaryHandler = Callable[[HomeAssistant, ActiveConnection, bytes], None]
 
@@ -201,6 +211,7 @@ def async_handle(self, msg: JsonValueType) -> None:
                 or type(type_) is not str
             )
         ):
+            msg = async_redact_data(msg, REDACT_KEYS)
             self.logger.error("Received invalid command: %s", msg)
             id_ = msg.get("id") if isinstance(msg, dict) else 0
             self.send_message(
@@ -264,6 +275,7 @@ def _connect_closed_error(
         self, msg: bytes | str | dict[str, Any] | Callable[[], str]
     ) -> None:
         """Send a message when the connection is closed."""
+        msg = async_redact_data(msg, REDACT_KEYS)
         self.logger.debug("Tried to send message %s on closed connection", msg)
 
     @callback
@@ -315,4 +327,5 @@ def async_handle_exception(self, msg: dict[str, Any], err: Exception) -> None:
             err_message += f" ({code})"
         err_message += " " + self.get_description(current_request.get())
 
+        err_message = async_redact_data(err_message, REDACT_KEYS)
         log_handler("Error handling message: %s", err_message)