Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kingdom logs Expose MC API Key #1374

Open
mariolamassaavedra opened this issue Dec 18, 2023 · 1 comment
Open

Kingdom logs Expose MC API Key #1374

mariolamassaavedra opened this issue Dec 18, 2023 · 1 comment
Labels
bug Something isn't working

Comments

@mariolamassaavedra
Copy link

Describe the bug
When the Reporting server calls the Kingdom, the logs in the v2alpha-public-api-server-deployment print the MC's API Key which should be known only to the MC and the Reporting Server. The key is shown on the x-api-key value of the calls to the Kingdom

Steps to reproduce

  1. Call ListEventGroups method on the reporting server
  2. Locate the call in the v2alpha-public-api-server-deployment logs where the API key is printed

Component(s) affected
Kingdom - v2alpha-public-api-server-deployment

Version
0.4.2

Environment
Origin's To-be-Prod

Additional context
image

@mariolamassaavedra mariolamassaavedra added the bug Something isn't working label Dec 18, 2023
@SanjayVas
Copy link
Member

SanjayVas commented Dec 18, 2023

Need to investigate whether this is only when verbose debug logging is enabled. We likely still don't want it to be logged even then, but at least it would mean that it's not logged in the production configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants