Skip to content

Prevent Bearer Token From Printing in Output #523

@g1t-out

Description

@g1t-out

Description of the Issue

When a Box API call fails through the SDK, it generates an error and could potentially print the bearer token out in plaintext on the console. The token can be used for a short period of time to take action as the calling user.

Steps to Reproduce

  1. Create an app that doesn't have permissions to complete a specific action.
  2. Make a request to do that action
  3. Observe the bearer token is printed out in plaintext

Expected Behavior

The token shouldn't be printed by default, perhaps for debugging purposes, certain flags can be set that would allow that level of debugging if needed.

Many people may have access to the logs, but they should not be granted the same rights as programs that are running.

Error Message, Including Stack Trace

box_sdk_gen.box.errors.BoxAPIError: 
Timestamp: 2025-03-24 21:31:41.404071
Underlying error: None
Message: 400 Bad Request; Request ID: 8e1xxahzsrqdq3wg
Request: 
        Method: PUT
        URL: https://api.box.com/2.0/users/<<REDACTED>>
        Query params: 
{}
        Headers: 
{       'Authorization': 'Bearer '
                         '<<REDACTED>>',
        'Content-Type': 'application/json',
        'User-Agent': 'box-python-generated-sdk-1.12.0',
        'X-Box-UA': 'agent=box-python-generated-sdk/1.12.0; env=python/3.12.9'}
        Body: 
'{"enterprise": null}'
Response: 
        Status code: 400
        Headers: 
{       'Alt-Svc': 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000',
        'Transfer-Encoding': 'chunked',
        'box-request-id': '14cb313f002284cb01e0f33e083a86c4d',
        'cache-control': 'no-cache, no-store',
        'content-type': 'application/json',
        'date': 'Mon, 24 Mar 2025 21:31:41 GMT',
        'strict-transport-security': 'max-age=31536000',
        'via': '1.1 google',
        'x-envoy-upstream-service-time': '299'}
        Code: bad_request
        Context Info: 
{       'errors': [       {       'message': "Invalid value 'Box_User "
                                             "<<REDACTED>>'.",
                                  'name': 'user',
                                  'reason': 'invalid_parameter'}]}
        Request Id: 8e1xxahzsrqdq3wg
        Help Url: http://developers.box.com/docs/#errors
        Body: 
{       'code': 'bad_request',
        'context_info': {       'errors': [       {       'message': 'Invalid '
                                                                     'value '
                                                                     "'Box_User "
                                                                     "<<REDACTED>>'.",
                                                          'name': 'user',
                                                          'reason': 'invalid_parameter'}]},
        'help_url': 'http://developers.box.com/docs/#errors',
        'message': 'Bad Request',
        'request_id': '8e1xxahzsrqdq3wg',
        'status': 400,
        'type': 'error'}
        Raw body: {"type":"error","status":400,"code":"bad_request","context_info":{"errors":[{"reason":"invalid_parameter","name":"user","message":"Invalid value 'Box_User <<REDACTED>>'."}]},"help_url":"http:\/\/developers.box.com\/docs\/#errors","message":"Bad Request","request_id":"8e1xxahzsrqdq3wg"}

Screenshots

Versions Used

Python SDK: 1.12.0
Python: 3.12.9

Metadata

Metadata

Labels

questionFurther information is requestedstaleAdded to issues should be staled

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions