Aias00 opened a new issue, #10810:
URL: https://github.com/apache/rocketmq/issues/10810
### Problem
`DefaultAuthenticationProvider.doAuditLog()` writes the raw request
signature into authentication audit logs for both failed and successful
authentication attempts:
```java
log.info("[AUTHENTICATION] User:{} is authenticated failed with Signature =
{}.", context.getUsername(), context.getSignature());
log.debug("[AUTHENTICATION] User:{} is authenticated success with Signature
= {}.", context.getUsername(), context.getSignature());
```
Signatures are security-sensitive authentication material and should not be
emitted verbatim to logs.
### Impact
Operators may persist raw authentication signatures in log aggregation
systems, increasing credential-related exposure risk during authentication
failures or debug logging.
### Expected behavior
Authentication audit logs should preserve useful diagnostics, but redact or
summarize signatures instead of printing the raw value.
### Code evidence
-
`auth/src/main/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProvider.java`
### Suggested fix
Mask the signature before logging, and add tests covering both short and
long signatures.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
