From ae830a56581b30f330ff1d7580f394d1124967ac Mon Sep 17 00:00:00 2001 From: agent-qv Date: Sun, 18 Oct 2026 22:13:12 +0200 Subject: [PATCH] Stop writing the bearer token to the log AuthTokenAuthenticator logged the token at debug level, and the whole Authorization header when it did not match "Bearer ". That looks harmless with APP_LOG_LEVEL=info, but config/packages/monolog.yaml also defines filter_for_errors, a fingers_crossed handler whose nested file_log handler has no level: as soon as a request logs one error, every record buffered for that request, debug included, is written to mcp.log. A failed tool call or a token refused by iTop is enough to put the token in the log in clear. The messages stay, only the secret goes. The logging setup is left as it is: escalating to debug on error is useful, a secret in a debug message is not. --- src/Security/AuthTokenAuthenticator.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Security/AuthTokenAuthenticator.php b/src/Security/AuthTokenAuthenticator.php index 9694090..de171e7 100644 --- a/src/Security/AuthTokenAuthenticator.php +++ b/src/Security/AuthTokenAuthenticator.php @@ -49,12 +49,12 @@ public function authenticate(Request $request): Passport $matches = []; if (!preg_match('/^Bearer (.+)$/', $authorizationHeader, $matches)) { // The Authorization header was improperly formatted, authentication fails - $this->mcpLogger->debug("Invalid authorization header format. Expecting: 'Bearer ', but got '$authorizationHeader'"); + $this->mcpLogger->debug("Invalid authorization header format. Expecting: 'Bearer '."); throw new CustomUserMessageAuthenticationException('Invalid authorization header format. Expecting: Bearer '); } $token = $matches[1]; $this->mcpLogger->debug("Authorization header format Ok."); - $this->mcpLogger->debug("Bearer token = '$token'."); + $this->mcpLogger->debug("Bearer token received."); return new SelfValidatingPassport(new UserBadge($token), []); }