Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Heartbeat] redact authorization headers from logger #26892

Merged
merged 2 commits into from
Jul 16, 2021

Conversation

vigneshshanmugam
Copy link
Member

  • Heartbeat allows users to pass custom headers for monitors when doing Lightweight HTTP checks. Any errors thrown on the configuration failure would result in configuration printed to the stdout including the sensitive headers (auth) in this case.
  • This PR redacts the authorization headers by adding them to the logger and also makes sure we capture both lowercase and uppercase strings as both are allowed for HTTP header checks. Added tests for the same

Heartbeat logs after this PR

ERROR [autodiscover]	autodiscover/autodiscover.go:212	Auto discover config check failed for config '{
  "headers": {
    "Authorization": "xxxxx",
    "Content-Type": "application/json"
  },
  "hosts": [
    "xxxxx"
  ],
  "id": "test",
  "schedule": "@every 10s",
  "type": "tcp"
}', won't start runner: monitor ID test is configured for multiple monitors! IDs must be unique values.

@vigneshshanmugam vigneshshanmugam added bug Team:obs-ds-hosted-services Label for the Observability Hosted Services team v7.14.0 labels Jul 14, 2021
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jul 14, 2021
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jul 14, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2021-07-15T14:43:24.450+0000

  • Duration: 144 min 0 sec

  • Commit: b943cce

Test stats 🧪

Test Results
Failed 0
Passed 49267
Skipped 5396
Total 54663

Trends 🧪

Image of Build Times

Image of Tests

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test Results
Failed 0
Passed 49267
Skipped 5396
Total 54663

@vigneshshanmugam
Copy link
Member Author

/test

@@ -27,13 +29,14 @@ var maskList = MakeStringSet(
"urls",
"host",
"hosts",
"authorization",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add proxy-authorization as well. We have a few inputs (including heartbeat) that allow users to configure proxies.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done 👍🏽

@urso
Copy link

urso commented Jul 16, 2021

Thank you! Please backport to 7.x, 7.14, and 7.13 branches.

@vigneshshanmugam vigneshshanmugam added backport-v7.13.0 Automated backport with mergify backport-v7.14.0 Automated backport with mergify backport-v7.15.0 Automated backport with mergify labels Jul 16, 2021
@vigneshshanmugam vigneshshanmugam merged commit 3598bd8 into elastic:master Jul 16, 2021
@vigneshshanmugam vigneshshanmugam deleted the redact-headers branch July 16, 2021 14:38
mergify bot pushed a commit that referenced this pull request Jul 16, 2021
* [Heartbeat] redact authorization headers from logger

* add proxy-auth headers to the list

(cherry picked from commit 3598bd8)
mergify bot pushed a commit that referenced this pull request Jul 16, 2021
* [Heartbeat] redact authorization headers from logger

* add proxy-auth headers to the list

(cherry picked from commit 3598bd8)
mergify bot pushed a commit that referenced this pull request Jul 16, 2021
* [Heartbeat] redact authorization headers from logger

* add proxy-auth headers to the list

(cherry picked from commit 3598bd8)
vigneshshanmugam added a commit that referenced this pull request Jul 16, 2021
* [Heartbeat] redact authorization headers from logger

* add proxy-auth headers to the list

(cherry picked from commit 3598bd8)

Co-authored-by: Vignesh Shanmugam <vignesh.shanmugam22@gmail.com>
vigneshshanmugam added a commit that referenced this pull request Jul 16, 2021
* [Heartbeat] redact authorization headers from logger

* add proxy-auth headers to the list

(cherry picked from commit 3598bd8)

Co-authored-by: Vignesh Shanmugam <vignesh.shanmugam22@gmail.com>
vigneshshanmugam added a commit that referenced this pull request Jul 17, 2021
* [Heartbeat] redact authorization headers from logger

* add proxy-auth headers to the list

(cherry picked from commit 3598bd8)

Co-authored-by: Vignesh Shanmugam <vignesh.shanmugam22@gmail.com>
mdelapenya added a commit to mdelapenya/beats that referenced this pull request Jul 19, 2021
* master: (61 commits)
  Add disk queue unit tests based on the queuetest package
  [Heartbeat] redact authorization headers from logger (elastic#26892)
  Expose custom process metrics  (elastic#26912)
  [gcp/billing] always quote table name identifier (elastic#26870)
  Add Beats central management removal to BCs (elastic#26400)
  Add custom suffix to identifiers in filestream input when needed (elastic#26669)
  Update asa-ftd-pipeline.yml (elastic#26265)
  Use common host parser in vsphere module (elastic#26904)
  [automation] Update go release version 1.16.6 (elastic#26860)
  Skip flaky test: filestream and harvester group (elastic#26728)
  [Filebeat] Remove alias fields from Suricata and Traefik module mappings (elastic#26627)
  docs: apm-server.auth (elastic#26831)
  [Automation] Update elastic stack version to 8.0.0-2f008f4a for testing (elastic#26881)
  Clarify the scope of start/end multiline example (elastic#26786)
  [Heartbeat]: update Node.js version for synthetics (elastic#26867)
  [fix][httpjson] Fix incorrect key for template data (elastic#26848)
  [httpjson] Add value_type parameter to httpjson transforms (elastic#26847)
  [Heartbeat]: capture error from journey/end events (elastic#26781)
  [Winlogbeat] Fixes for wineventlog experimental api (elastic#26826)
  Set agent.id to Fleet Agent ID for each metric/log monitoring input (elastic#26776)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-v7.13.0 Automated backport with mergify backport-v7.14.0 Automated backport with mergify backport-v7.15.0 Automated backport with mergify bug Team:obs-ds-hosted-services Label for the Observability Hosted Services team v7.14.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants