Logan CusanoandClaude Opus 5
0bd92269d2
httpx logs every request at INFO as a full URL including the query string, so the Google Maps key appeared in c2-core's container logs on every geocode call -- `?address=Holland+Station&...&key=AIza...`. Anyone who can read the logs, or who is pasted a few lines of them, has the key. It was found exactly that way while checking why the map was empty. Nothing in this service needs per-request client logging; callers already log their own failures with context. httpx and httpcore drop to WARNING, so real transport errors still surface and the URLs stop being printed. This does not un-leak the existing key -- it is in the container's log history and has to be rotated in GCP separately. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
19 lines
705 B
Python
19 lines
705 B
Python
import logging
|
|
import sys
|
|
|
|
logging.basicConfig(
|
|
level=logging.INFO,
|
|
format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
|
|
handlers=[logging.StreamHandler(sys.stdout)],
|
|
)
|
|
|
|
# httpx logs every request at INFO as a full URL *including the query string*,
|
|
# which puts API keys in plaintext in container logs — the Google Maps key was
|
|
# leaking on every geocode call (`?address=...&key=AIza...`). Nothing here needs
|
|
# per-request client logging, so drop httpx to WARNING; failures still surface
|
|
# because the callers log their own errors.
|
|
logging.getLogger("httpx").setLevel(logging.WARNING)
|
|
logging.getLogger("httpcore").setLevel(logging.WARNING)
|
|
|
|
logger = logging.getLogger("drb-c2-core")
|