Apache Airflow version
3.1.7
If "Other Airflow 3 version" selected, which one?
No response
What happened?
We discovered JWT tokens appearing in the logs.
There exists a function for redacting JWT tokens
|
# `eyJ` is `{"` in base64 encoding -- and any value that starts like that is very likely a JWT |
|
# token. Better safe than sorry |
|
def redact_jwt(logger: Any, method_name: str, event_dict: EventDict) -> EventDict: |
|
for k, v in event_dict.items(): |
|
if isinstance(v, str): |
|
event_dict[k] = re.sub(JWT_PATTERN, "eyJ***", v) |
|
return event_dict |
|
|
|
|
|
def drop_positional_args(logger: Any, method_name: Any, event_dict: EventDict) -> EventDict: |
|
event_dict.pop("positional_args", None) |
|
return event_dict |
But it doesn't work for this line, presumably because workload is an object not a string -
|
log.info("Executing workload", workload=workload) |
The workload object has a JWT embedded inside it.
What you think should happen instead?
No response
How to reproduce
Run any DAG
Operating System
debian bookworm
Versions of Apache Airflow Providers
No response
Deployment
Official Apache Airflow Helm Chart
Deployment details
No response
Anything else?
No response
Are you willing to submit PR?
Code of Conduct
Apache Airflow version
3.1.7
If "Other Airflow 3 version" selected, which one?
No response
What happened?
We discovered JWT tokens appearing in the logs.
There exists a function for redacting JWT tokens
airflow/shared/logging/src/airflow_shared/logging/structlog.py
Lines 205 to 216 in c7cbced
But it doesn't work for this line, presumably because
workloadis an object not a string -airflow/task-sdk/src/airflow/sdk/execution_time/execute_workload.py
Line 56 in c7cbced
The workload object has a JWT embedded inside it.
What you think should happen instead?
No response
How to reproduce
Run any DAG
Operating System
debian bookworm
Versions of Apache Airflow Providers
No response
Deployment
Official Apache Airflow Helm Chart
Deployment details
No response
Anything else?
No response
Are you willing to submit PR?
Code of Conduct