Skip to content
This repository was archived by the owner on Sep 15, 2025. It is now read-only.
This repository was archived by the owner on Sep 15, 2025. It is now read-only.

Bug: Logging of Social Login exposes OAuth Bearer token to log files #149

Description

@astralbodies

Expected behavior

Log entries shouldn't include sensitive data like bearer tokens.

Actual behavior

When logging in with social login the entire response object is dumped to the log and exposes the bearer token to the app's log file.

DDLogVerbose("Received Social Login Oauth response: \(self.cleanedUpResponseForLogging(responseObject as AnyObject? ?? "nil" as AnyObject))")

2019/04/27 12:57:11:934  Received Social Login Oauth response: {
    data =     {
        "bearer_token" = "manually redacted by me for demo purposes";
        "token_links" =         (
            "https://jetpack.com/remote-login.php?wpcom_remote_login=validate&wpcomid=xx&token=xx&host=https%3A%2F%2Fjetpack.com"
        );
    };
    success = 1;
}

Steps to reproduce the behavior

  1. Use Social Login and look at the log file.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions