-
Notifications
You must be signed in to change notification settings - Fork 139
Open
Description
- Pyrollbar appends access_token to payload in several places: _build_payload, _get_api
- In cases where the endpoint returns error 429 or error 413, the payload is logged in full, including access_token field (
Rollbar: over rate limit, data was dropped. Payload was: '{"access_token": "...", "data": ...}) - this behavior cannot be configured. In case of error 429 one may set
SETTINGS['log_all_rate_limited_items'], but the rate limit error will still be called at least once. - In end effect the access token may become exposed in rollbar logs. This is a security issue.
Solutions I see
- Since it is only access_token variable that is added to the data, directly replace it
params_sanitized = params.replace(access_token if access_token else SETTINGS['access_token'], '***') - Scrub the payload in _parse_response the same way the underlying log is scrubbed
- Add
log_payload_on_errorsetting that would control this behavior
Happy to fix this myself. What's the best way to go about this?
Metadata
Metadata
Assignees
Labels
No labels