Hi!
I have a 9.9.0 Sonarqube server running, and when I downloaded access logs from the system tabs, I saw that it saved user logins with plaintext passwords. Is there a way to configure this fromat to hide or remove the passwords?
Thanks in advance!
Kornél
Hey there.
That’s weird, and shouldn’t be the default behavior. Can you give an example (redacted of course).
yes here is one example:
2024-08-01T00:05:57.335+02:00 | [IP address] | [-] | [-] | [POST /api/authentication/login HTTP/1.1] | [200] | [-] | [Sonar URL] | [browser data] | [login=realusername&realpassword] | [Some kind of token] | [-] | -
The default logging for SonarQube looks like this:
0:0:0:0:0:0:0:1 - - [05/Aug/2024:08:32:31 +0200] "POST /api/authentication/login HTTP/1.1" 200 - "http://localhost:9000/sessions/new?return_to=%2F" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "33f147a2-0326-4a4f-b176-1cac72ee8edf" 193
Has somebody adjusted sonar.web.accessLogs.pattern in your conf/sonar.properties file?
Hey, there OP here. The web access log format is the following:
“%i{X-Forwarded-For} %l %u [%t] "%r" %s %b "%i{Referer}" "%i{User-Agent}"”
is there a way to display username login, but without a password?
Hey @tkornel2
I dug into this a bit more. I realized that it’s only happening when I make a curl request rather than using the UI. Do you confirm it’s the same on your side?
hey, it happens when I login through the UI, even failed attempts get logged
I really think your Access Log pattern can’t be what you think it is. Can you check the value of sonar.web.accessLogs.pattern in your “System Info” (see below) and/or share your system info here?
You are right, this is the format:
“sonar.web.accessLogs.pattern”:“%t{yyyy-MM-dd\u0027T\u0027HH:mm:ss.SSSXXX} | [%i{X-Forwarded-For}] | [%l] | [%u] | [%r] | [%s] | [%b] | [%i{Referer}] | [%i{User-Agent}] | [%requestContent] | [%reqAttribute{ID}] | [%reqAttribute{LOGIN}] | %reqAttribute{TOKEN_NAME}”
when the requestcontent is logged, it contains the sensitive data, during user/pass auth
Okay! The presence of this is exposing the details.
So it really comes down to where this config is coming from. I suggest:
- Double checking your conf/sonar.properties file (check for the string
[%requestContent]specifically!) - Check that
SONAR_WEB_ACCESSLOGS_PATTERNis not an environment variable set in your environment - If that fails, please tell us more about your SonarQube deployment. How is it deployed? From the ZIP file? A Docker image? Something else?