yahoo-eng-team team mailing list archive

[Cedric Brandily <1516691@xxxxxxxxxxxxxxxxxx>]

This bug concerns python-neutronclient not neutron

** Also affects: python-neutronclient
   Importance: Undecided
       Status: New

** Changed in: neutron
       Status: New => Invalid

** Changed in: neutron
     Assignee: Manjeet Singh Bhatia (manjeet-s-bhatia) => (unassigned)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1516691

Title:
  neutronclient logs sensitive info in http requests

Status in neutron:
  Invalid
Status in python-neutronclient:
  New

Bug description:
  neutronclient logs sensitive info in headers when logging http
  requests in debug mode.

  /usr/lib/python2.7/site-
  packages/neutronclient/common/utils.py:http_log_req()

  neutronclient should hash sensitive info in headers such as 'X-Auth-Token' and 'X-Subject-Token'.
  For examples, see keystoneclient (https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/openstack/common/apiclient/client.py#L105), glanceclient, or ceilometerclient.

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1516691/+subscriptions