You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
DDLogVerbose("Received Social Login Oauth response: \(self.cleanedUpResponseForLogging(responseObject asAnyObject???"nil"asAnyObject))")
2019/04/27 12:57:11:934 Received Social Login Oauth response: {
data = {
"bearer_token" = "manually redacted by me for demo purposes";
"token_links" = (
"https://jetpack.com/remote-login.php?wpcom_remote_login=validate&wpcomid=xx&token=xx&host=https%3A%2F%2Fjetpack.com"
);
};
success = 1;
}
Expected behavior
Log entries shouldn't include sensitive data like bearer tokens.
Actual behavior
When logging in with social login the entire response object is dumped to the log and exposes the bearer token to the app's log file.
WordPressKit-iOS/WordPressKit/WordPressComOAuthClient.swift
Line 274 in c834839
Steps to reproduce the behavior