diff --git a/app/authentication.go b/app/authentication.go index 899776b81d..1dd541b4da 100644 --- a/app/authentication.go +++ b/app/authentication.go @@ -282,7 +282,15 @@ func (a *App) authenticateUser(c *request.Context, user *model.User, password, m return user, nil } -func ParseAuthTokenFromRequest(r *http.Request) (string, TokenLocation) { +func ParseAuthTokenFromRequest(r *http.Request) (token string, loc TokenLocation) { + defer func() { + // Stripping off tokens of large sizes + // to prevent logging a large string. + if len(token) > 50 { + token = token[:50] + } + }() + authHeader := r.Header.Get(model.HeaderAuth) // Attempt to parse the token from the cookie diff --git a/app/authentication_test.go b/app/authentication_test.go index dd314cb9f2..38e83cc383 100644 --- a/app/authentication_test.go +++ b/app/authentication_test.go @@ -26,6 +26,7 @@ func TestParseAuthTokenFromRequest(t *testing.T) { {"token mytoken", "", "", "mytoken", TokenLocationHeader}, {"BEARER mytoken", "", "", "mytoken", TokenLocationHeader}, {"", "mytoken", "", "mytoken", TokenLocationCookie}, + {"", "a very large token to test out tokentokentokentokentokentokentokentokentokentokentokentokentoken", "", "a very large token to test out tokentokentokentoke", TokenLocationCookie}, {"", "", "mytoken", "mytoken", TokenLocationQueryString}, {"mytoken", "", "", "mytoken", TokenLocationCloudHeader}, }