From 4d95241397884e9181f5b4c96b691c6c77ff8acc Mon Sep 17 00:00:00 2001 From: Ishaan Jaff Date: Thu, 2 Oct 2025 15:07:37 -0700 Subject: [PATCH] [Security Fix] fix: don't log JWT SSO token on .info() log (#15145) * fix: get_redirect_response_from_openid * fix info log check * fix: forward_upstream_to_client --- litellm/proxy/management_endpoints/ui_sso.py | 1 - tests/code_coverage_tests/info_log_check.py | 23 ++++++++++++++------ 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py index 1227a5017b2..a65b9cc95d2 100644 --- a/litellm/proxy/management_endpoints/ui_sso.py +++ b/litellm/proxy/management_endpoints/ui_sso.py @@ -1594,7 +1594,6 @@ class SSOAuthenticationHandler: master_key or "", algorithm="HS256", ) - verbose_proxy_logger.info(f"user_id: {user_id}; jwt_token: {jwt_token}") if user_id is not None and isinstance(user_id, str): litellm_dashboard_ui += "?login=success" verbose_proxy_logger.info(f"Redirecting to {litellm_dashboard_ui}") diff --git a/tests/code_coverage_tests/info_log_check.py b/tests/code_coverage_tests/info_log_check.py index e8541b4358a..44e73a6c216 100644 --- a/tests/code_coverage_tests/info_log_check.py +++ b/tests/code_coverage_tests/info_log_check.py @@ -126,8 +126,13 @@ class SensitiveLogDetector(ast.NodeVisitor): for value in arg.values: if isinstance(value, ast.FormattedValue): value_str = self._get_arg_string(value.value).lower() - if any(pattern in value_str for pattern in - ['request', 'response', 'data', 'body', 'content', 'messages']): + # Check for any sensitive data patterns in f-string interpolations + sensitive_f_string_patterns = [ + 'request', 'response', 'data', 'body', 'content', 'messages', + 'token', 'jwt', 'auth', 'api_key', 'apikey', 'credential', + 'secret', 'password', 'passwd' + ] + if any(pattern in value_str for pattern in sensitive_f_string_patterns): return True # Check for .format() calls @@ -137,10 +142,14 @@ class SensitiveLogDetector(ast.NodeVisitor): base_str = self._get_arg_string(arg.func.value).lower() if "{}" in base_str or "{" in base_str: # Check format arguments for sensitive data + sensitive_format_patterns = [ + 'request', 'response', 'data', 'body', 'content', + 'token', 'jwt', 'auth', 'api_key', 'apikey', 'credential', + 'secret', 'password', 'passwd' + ] for format_arg in arg.args: format_str = self._get_arg_string(format_arg).lower() - if any(pattern in format_str for pattern in - ['request', 'response', 'data', 'body', 'content']): + if any(pattern in format_str for pattern in sensitive_format_patterns): return True return False @@ -171,7 +180,9 @@ class SensitiveLogDetector(ast.NodeVisitor): """Get a human-readable reason for the violation""" arg_str = self._get_arg_string(arg).lower() - if 'request' in arg_str: + if any(pattern in arg_str for pattern in ['jwt', 'token', 'api_key', 'apikey', 'auth', 'credential', 'secret', 'password', 'passwd']): + return "Potentially logging authentication/secret data (JWT, token, API key, etc.)" + elif 'request' in arg_str: return "Potentially logging request data" elif 'response' in arg_str: return "Potentially logging response data" @@ -179,8 +190,6 @@ class SensitiveLogDetector(ast.NodeVisitor): return "Potentially logging sensitive data/body/content" elif any(pattern in arg_str for pattern in ['messages', 'input', 'output']): return "Potentially logging message/input/output data" - elif any(pattern in arg_str for pattern in ['api_key', 'token', 'auth', 'credentials']): - return "Potentially logging authentication data" else: return "Potentially logging sensitive data"