Skip to content

fix(security): mask Authorization header value in SPNEGO error messages#3078

Merged
marevol merged 1 commit intomasterfrom
fix/mask-authorization-header-in-spnego-error
Mar 15, 2026
Merged

fix(security): mask Authorization header value in SPNEGO error messages#3078
marevol merged 1 commit intomasterfrom
fix/mask-authorization-header-in-spnego-error

Conversation

@marevol
Copy link
Contributor

@marevol marevol commented Mar 15, 2026

Summary

  • SPNEGO認証失敗時の例外メッセージとデバッグログで、Authorizationヘッダーの値をマスクするように修正
  • Kerberos/NTLMトークンやBase64エンコードされた認証情報がログや例外メッセージに漏洩するリスクを防止
  • ヘッダー値の先頭10文字のみ表示し、残りを *** でマスク(スキーム名の確認は可能)

Test plan

  • SPNEGO認証が有効な環境で認証失敗時のログを確認し、トークンがマスクされていることを検証
  • mvn package ビルド成功を確認済み

🤖 Generated with Claude Code

Prevent leaking Kerberos/NTLM tokens or Base64-encoded credentials
in exception messages and debug logs when SPNEGO authentication fails.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@marevol marevol merged commit 3e0b05c into master Mar 15, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant