Remove token value from log messages in legacy router files #35

New Issue

cal · 2026-02-20T06:50:55Z

cal commented

2026-02-20 06:50:55 +00:00

Several router files log the raw bearer token on 401 failures (e.g. plays.py:37: logger.warning(f"patch_play - Bad Token: {token}")). The handle_db_errors decorator correctly redacts tokens, but explicit logger.warning calls bypass that protection.

Priority: medium | Labels: security

Several router files log the raw bearer token on 401 failures (e.g. `plays.py:37`: `logger.warning(f"patch_play - Bad Token: {token}")`). The `handle_db_errors` decorator correctly redacts tokens, but explicit logger.warning calls bypass that protection. **Priority**: medium | **Labels**: security

cal added the

ai-working

label 2026-03-05 17:30:56 +00:00

cal referenced this issue from a commit

2026-03-05 17:32:20 +00:00

fix: remove token value from Bad Token log messages (#35)

cal referenced a pull request that will close this issue

2026-03-05 17:32:27 +00:00

fix: remove token value from Bad Token log messages (#35) #45

cal added the

ai-pr-opened

label 2026-03-05 17:32:33 +00:00

cal commented

2026-03-05 17:32:35 +00:00

Fixed in PR #45: #45

Removed raw bearer token interpolation from 22 router files. All logger.warning(f'... Bad Token: {token}') calls converted to static strings like logger.warning('... Bad Token'). No token value is now logged on 401 failures.

Fixed in PR #45: https://git.manticorum.com/cal/major-domo-database/pulls/45 Removed raw bearer token interpolation from 22 router files. All `logger.warning(f'... Bad Token: {token}')` calls converted to static strings like `logger.warning('... Bad Token')`. No token value is now logged on 401 failures.

cal removed the

ai-working

label 2026-03-05 17:32:37 +00:00

Sign in to join this conversation.