Skip to content

Disable logging full payload with access token after errors #486

@PoCTo

Description

@PoCTo
  • Pyrollbar appends access_token to payload in several places: _build_payload, _get_api
  • In cases where the endpoint returns error 429 or error 413, the payload is logged in full, including access_token field (Rollbar: over rate limit, data was dropped. Payload was: '{"access_token": "...", "data": ...})
  • this behavior cannot be configured. In case of error 429 one may set SETTINGS['log_all_rate_limited_items'], but the rate limit error will still be called at least once.
  • In end effect the access token may become exposed in rollbar logs. This is a security issue.

Solutions I see

  1. Since it is only access_token variable that is added to the data, directly replace it params_sanitized = params.replace(access_token if access_token else SETTINGS['access_token'], '***')
  2. Scrub the payload in _parse_response the same way the underlying log is scrubbed
  3. Add log_payload_on_error setting that would control this behavior

Happy to fix this myself. What's the best way to go about this?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions