When a Box API call fails through the SDK, it generates an error and could potentially print the bearer token out in plaintext on the console. The token can be used for a short period of time to take action as the calling user.
The token shouldn't be printed by default, perhaps for debugging purposes, certain flags can be set that would allow that level of debugging if needed.
Many people may have access to the logs, but they should not be granted the same rights as programs that are running.
box_sdk_gen.box.errors.BoxAPIError:
Timestamp: 2025-03-24 21:31:41.404071
Underlying error: None
Message: 400 Bad Request; Request ID: 8e1xxahzsrqdq3wg
Request:
Method: PUT
URL: https://api.box.com/2.0/users/<<REDACTED>>
Query params:
{}
Headers:
{ 'Authorization': 'Bearer '
'<<REDACTED>>',
'Content-Type': 'application/json',
'User-Agent': 'box-python-generated-sdk-1.12.0',
'X-Box-UA': 'agent=box-python-generated-sdk/1.12.0; env=python/3.12.9'}
Body:
'{"enterprise": null}'
Response:
Status code: 400
Headers:
{ 'Alt-Svc': 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000',
'Transfer-Encoding': 'chunked',
'box-request-id': '14cb313f002284cb01e0f33e083a86c4d',
'cache-control': 'no-cache, no-store',
'content-type': 'application/json',
'date': 'Mon, 24 Mar 2025 21:31:41 GMT',
'strict-transport-security': 'max-age=31536000',
'via': '1.1 google',
'x-envoy-upstream-service-time': '299'}
Code: bad_request
Context Info:
{ 'errors': [ { 'message': "Invalid value 'Box_User "
"<<REDACTED>>'.",
'name': 'user',
'reason': 'invalid_parameter'}]}
Request Id: 8e1xxahzsrqdq3wg
Help Url: http://developers.box.com/docs/#errors
Body:
{ 'code': 'bad_request',
'context_info': { 'errors': [ { 'message': 'Invalid '
'value '
"'Box_User "
"<<REDACTED>>'.",
'name': 'user',
'reason': 'invalid_parameter'}]},
'help_url': 'http://developers.box.com/docs/#errors',
'message': 'Bad Request',
'request_id': '8e1xxahzsrqdq3wg',
'status': 400,
'type': 'error'}
Raw body: {"type":"error","status":400,"code":"bad_request","context_info":{"errors":[{"reason":"invalid_parameter","name":"user","message":"Invalid value 'Box_User <<REDACTED>>'."}]},"help_url":"http:\/\/developers.box.com\/docs\/#errors","message":"Bad Request","request_id":"8e1xxahzsrqdq3wg"}
Description of the Issue
When a Box API call fails through the SDK, it generates an error and could potentially print the bearer token out in plaintext on the console. The token can be used for a short period of time to take action as the calling user.
Steps to Reproduce
Expected Behavior
The token shouldn't be printed by default, perhaps for debugging purposes, certain flags can be set that would allow that level of debugging if needed.
Many people may have access to the logs, but they should not be granted the same rights as programs that are running.
Error Message, Including Stack Trace
Screenshots
Versions Used
Python SDK: 1.12.0
Python: 3.12.9