From df20578a784bb661cad770ee1794aca12b97fffc Mon Sep 17 00:00:00 2001 From: Raja Subramanian Date: Fri, 14 Aug 2026 11:51:14 +0530 Subject: [PATCH] =?UTF-8?q?Remove=20auth=20token=20from=20log/being=20sent?= =?UTF-8?q?=20back=20to=20client=20on=20invalid=20token=E2=80=A6=20(#4756)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Remove auth token from log/being sent back to client on invalid token error * actually remove API key also --- pkg/service/auth.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/service/auth.go b/pkg/service/auth.go index d019c4aae..3fcc1ce49 100644 --- a/pkg/service/auth.go +++ b/pkg/service/auth.go @@ -17,6 +17,7 @@ package service import ( "context" "errors" + "fmt" "net/http" "strings" "time" @@ -88,13 +89,13 @@ func (m *APIKeyAuthMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request, secret := m.provider.GetSecret(v.APIKey()) if secret == "" { - HandleError(w, r, http.StatusUnauthorized, errors.New("invalid API key: "+v.APIKey())) + HandleError(w, r, http.StatusUnauthorized, ErrInvalidAPIKey) return } claims, grants, err := v.Verify(secret) if err != nil { - HandleError(w, r, http.StatusUnauthorized, errors.New("invalid token: "+authToken+", error: "+err.Error())) + HandleError(w, r, http.StatusUnauthorized, fmt.Errorf("%w: %s", ErrInvalidAuthorizationToken, err.Error())) return }