From 24358417a35eebb2c0a370b820bcc08b414a42d6 Mon Sep 17 00:00:00 2001 From: Tanmaya Panda Date: Tue, 4 Aug 2026 23:20:59 +0530 Subject: [PATCH] out_azure_kusto: stop logging federated and access tokens The workload identity auth path logged the raw federated token at info level right after reading it from the projected token file, so a valid Entra ID client assertion was written to the log on every token exchange. The token exchange debug log leaked the same assertion through the request body, and the MSI debug log leaked the issued access token through the response payload. Log only the token file path and the body/payload sizes, so the auth flow stays debuggable without writing credentials to the log. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1176b3da-527b-494b-8ef3-7f29904ad29e Signed-off-by: Tanmaya Panda --- plugins/out_azure_kusto/azure_msiauth.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/plugins/out_azure_kusto/azure_msiauth.c b/plugins/out_azure_kusto/azure_msiauth.c index 384ffa588df..8c995491032 100644 --- a/plugins/out_azure_kusto/azure_msiauth.c +++ b/plugins/out_azure_kusto/azure_msiauth.c @@ -77,7 +77,9 @@ char *flb_azure_msiauth_token_get(struct flb_oauth2 *ctx) flb_info("[azure msi auth] HTTP Status=%i", c->resp.status); if (c->resp.payload_size > 0) { if (c->resp.status == 200) { - flb_debug("[azure msi auth] payload:\n%s", c->resp.payload); + /* the payload carries the access token, never log its content */ + flb_debug("[azure msi auth] token response received (%zu bytes)", + c->resp.payload_size); } else { flb_info("[azure msi auth] payload:\n%s", c->resp.payload); @@ -162,7 +164,9 @@ int flb_azure_workload_identity_token_get(struct flb_oauth2 *ctx, const char *to return -1; } - flb_info("[azure workload identity] after read token from file %s", federated_token); + /* the federated token is a credential, only log its size */ + flb_debug("[azure workload identity] federated token read from %s (%zu bytes)", + token_file, flb_sds_len(federated_token)); /* Build the form data for token exchange *before* creating the client */ body = flb_sds_create_size(4096); @@ -249,8 +253,9 @@ int flb_azure_workload_identity_token_get(struct flb_oauth2 *ctx, const char *to /* c->body_buf = body; */ /* c->body_len = flb_sds_len(body); */ - /* Add a debug log to verify the body content just before sending */ - flb_debug("[azure workload identity] Sending request body (len=%zu): %s", flb_sds_len(body), body); + /* the body embeds the client assertion, never log its content */ + flb_debug("[azure workload identity] sending token exchange request (body len=%zu)", + flb_sds_len(body)); /* Issue request */ ret = flb_http_do(c, &b_sent);