This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.1 by this push:
new 8ab39e4ded9 branch-4.1：[enhance](auth)Hidden the token info during
StreamLoad in BE info #60656 && [enhance](auth)Hidden the auth info during
StreamLoad in BE info #59743 (#65944)
8ab39e4ded9 is described below
commit 8ab39e4ded95b549a29b925afc2686a19e68bbe0
Author: Refrain <[email protected]>
AuthorDate: Thu Jul 23 20:22:32 2026 +0800
branch-4.1：[enhance](auth)Hidden the token info during StreamLoad in BE
info #60656 && [enhance](auth)Hidden the auth info during StreamLoad in BE info
#59743 (#65944)
### What problem does this PR solve?
Issue Number: close #xxx
Related PR: #60656, #59743
Problem Summary:
Pick https://github.com/apache/doris/pull/60656 and
https://github.com/apache/doris/pull/59743 to branch-4.1.
### Release note
None
### Check List (For Author)
- Test
- [x] No need to test or manual test.
- No tests were run as requested for this pick PR.
- Behavior changed: Yes. Sensitive authorization and token headers are
masked in BE Stream Load logs.
- Does this need documentation: No.
---
.../http/action/stream_load_forward_handler.cpp | 8 +-------
be/src/service/http/http_request.cpp | 20 ++++++++++++++++++--
2 files changed, 19 insertions(+), 9 deletions(-)
diff --git a/be/src/service/http/action/stream_load_forward_handler.cpp
b/be/src/service/http/action/stream_load_forward_handler.cpp
index 4c095e2251a..2b6268522bd 100644
--- a/be/src/service/http/action/stream_load_forward_handler.cpp
+++ b/be/src/service/http/action/stream_load_forward_handler.cpp
@@ -44,12 +44,6 @@ int StreamLoadForwardHandler::on_header(HttpRequest* req) {
return auth_ret;
}
- std::ostringstream headers_info;
- const auto& headers = req->headers();
- for (const auto& header : headers) {
- headers_info << header.first << ":" << header.second << " ";
- }
-
std::ostringstream params_info;
const auto* params = req->params();
for (const auto& param : *params) {
@@ -58,7 +52,7 @@ int StreamLoadForwardHandler::on_header(HttpRequest* req) {
LOG(INFO) << "StreamLoadForward request started - "
<< "path: " << req->raw_path() << ", remote: " <<
req->remote_host() << ", headers: ["
- << headers_info.str() << "]"
+ << req->get_all_headers() << "]"
<< ", params: [" << params_info.str() << "]";
std::shared_ptr<StreamLoadForwardContext> ctx(new
StreamLoadForwardContext());
diff --git a/be/src/service/http/http_request.cpp
b/be/src/service/http/http_request.cpp
index 22231200de5..4ae3c7c7f3e 100644
--- a/be/src/service/http/http_request.cpp
+++ b/be/src/service/http/http_request.cpp
@@ -36,6 +36,13 @@ namespace doris {
static std::string s_empty = "";
+// Helper function to check if a header should be masked in logs
+static bool is_sensitive_header(const std::string& header_name) {
+ return iequal(header_name, HttpHeaders::AUTHORIZATION) ||
+ iequal(header_name, HttpHeaders::PROXY_AUTHORIZATION) ||
iequal(header_name, "token") ||
+ iequal(header_name, HttpHeaders::AUTH_TOKEN);
+}
+
HttpRequest::HttpRequest(evhttp_request* evhttp_request) :
_ev_req(evhttp_request) {}
HttpRequest::~HttpRequest() {
@@ -87,7 +94,11 @@ std::string HttpRequest::debug_string() const {
<< "raw_path:" << _raw_path << "\n"
<< "headers: \n";
for (auto& iter : _headers) {
- ss << "key=" << iter.first << ", value=" << iter.second << "\n";
+ if (is_sensitive_header(iter.first)) {
+ ss << "key=" << iter.first << ", value=***MASKED***\n";
+ } else {
+ ss << "key=" << iter.first << ", value=" << iter.second << "\n";
+ }
}
ss << "params: \n";
for (auto& iter : _params) {
@@ -116,7 +127,12 @@ const std::string& HttpRequest::param(const std::string&
key) const {
std::string HttpRequest::get_all_headers() const {
std::stringstream headers;
for (const auto& header : _headers) {
- headers << header.first << ":" << header.second + ", ";
+ // Mask sensitive headers
+ if (is_sensitive_header(header.first)) {
+ headers << header.first << ":***MASKED***, ";
+ } else {
+ headers << header.first << ":" << header.second + ", ";
+ }
}
return headers.str();
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
