From a986132dcd9f93e53e23de2e2f77d18d9e89ba90 Mon Sep 17 00:00:00 2001 From: Magnus Jensen Date: Mon, 1 Dec 2025 15:32:59 -0300 Subject: [PATCH] disable android proxy debug logging and redact auth header (#36498) Part of QA finding, disables debug logging, since we have no good way of toggling based on Fleet's total logging level, but also added the Auth header redaction just for good measures. --- server/mdm/android/service/androidmgmt/proxy_client.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/server/mdm/android/service/androidmgmt/proxy_client.go b/server/mdm/android/service/androidmgmt/proxy_client.go index 533b5a89a6..dc1a60a93b 100644 --- a/server/mdm/android/service/androidmgmt/proxy_client.go +++ b/server/mdm/android/service/androidmgmt/proxy_client.go @@ -8,6 +8,7 @@ import ( "log/slog" "net/http" "os" + "slices" "github.com/fleetdm/fleet/v4/pkg/fleethttp" "github.com/fleetdm/fleet/v4/server/contexts/ctxerr" @@ -41,7 +42,13 @@ func NewProxyClient(ctx context.Context, logger kitlog.Logger, licenseKey string } slogLogger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{ - Level: slog.LevelDebug, + ReplaceAttr: func(groups []string, a slog.Attr) slog.Attr { + if slices.Contains(groups, "request") && slices.Contains(groups, "headers") && a.Key == "Authorization" { + // Redact request Authorization headers + a.Value = slog.StringValue("REDACTED") + } + return a + }, })) // We use the same client that we use to directly connect to Google to minimize issues/maintenance. // But we point it to our proxy endpoint instead of Google.