Skip to content

License keys are not kept out of logs, and the data update messages name the URL that carries them #51

Closed

Description

@jwrosewell

What happens

The URL a data update request is sent to carries the license keys in its query. The data update logging section gives messages that name that URL, such as "Checking for update from '<url>'" (lines 399 to 401) and the connection and download errors (lines 417 to 418). The logging feature says nothing about credentials. Following the specification therefore writes the license keys to the log.

The .NET pipeline logs the URL with the keys at Information level on every check (DataUpdateService.cs line 1192). The Java pipeline logs it at debug level on every download and at error level on every failed one (DataUpdateServiceDefault.java lines 595 to 640). The Rust SDK put them in its error messages.

What is needed

  1. The logging feature to say a license key never appears in a log entry or an error message, and that a message naming a URL that carries one names it with the key removed or replaced.
  2. The data update logging section to say the same of its <url>.

The change is #55. The Rust SDK's change is 51Degrees/51degrees-rust#175.

Activity

  1. added theissue type on Oct 27, 2026
  2. jwrosewell commented on Nov 13, 2026

    @jwrosewell
    ContributorAuthor

    Fixed on main (6570727, #134): logging.md line 20 says "A license key MUST NOT appear in full in a log entry or in an error message", lines 33 and 34 cover URLs, and data-updates.md lines 438 to 442 cover the data update URL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions