From dce96046dd5c2421cfcb6384c8e61f7e86b5a1a3 Mon Sep 17 00:00:00 2001
From: Agniva De Sarker <agnivade@yahoo.co.in>
Date: Thu, 9 Jun 2022 14:56:26 +0530
Subject: [PATCH] MM-42714: Trim token sizes to 50 characters (#20412)

https://mattermost.atlassian.net/browse/MM-42714

```release-note
NONE
```
---
 app/authentication.go      | 10 +++++++++-
 app/authentication_test.go |  1 +
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/app/authentication.go b/app/authentication.go
index 899776b81d..1dd541b4da 100644
--- a/app/authentication.go
+++ b/app/authentication.go
@@ -282,7 +282,15 @@ func (a *App) authenticateUser(c *request.Context, user *model.User, password, m
 	return user, nil
 }
 
-func ParseAuthTokenFromRequest(r *http.Request) (string, TokenLocation) {
+func ParseAuthTokenFromRequest(r *http.Request) (token string, loc TokenLocation) {
+	defer func() {
+		// Stripping off tokens of large sizes
+		// to prevent logging a large string.
+		if len(token) > 50 {
+			token = token[:50]
+		}
+	}()
+
 	authHeader := r.Header.Get(model.HeaderAuth)
 
 	// Attempt to parse the token from the cookie
diff --git a/app/authentication_test.go b/app/authentication_test.go
index dd314cb9f2..38e83cc383 100644
--- a/app/authentication_test.go
+++ b/app/authentication_test.go
@@ -26,6 +26,7 @@ func TestParseAuthTokenFromRequest(t *testing.T) {
 		{"token mytoken", "", "", "mytoken", TokenLocationHeader},
 		{"BEARER mytoken", "", "", "mytoken", TokenLocationHeader},
 		{"", "mytoken", "", "mytoken", TokenLocationCookie},
+		{"", "a very large token to test out tokentokentokentokentokentokentokentokentokentokentokentokentoken", "", "a very large token to test out tokentokentokentoke", TokenLocationCookie},
 		{"", "", "mytoken", "mytoken", TokenLocationQueryString},
 		{"mytoken", "", "", "mytoken", TokenLocationCloudHeader},
 	}