From 2ef9a5fff2155ec88f99698a2db4c3ca8230f3fa Mon Sep 17 00:00:00 2001 From: Gabriel Luiz Freitas Almeida Date: Wed, 1 Apr 2026 16:53:04 -0300 Subject: [PATCH] fix: redact sensitive information from log output (#12271) * fix: redact sensitive information from log output Mask or remove API keys, passwords, tokens, auth settings, and configuration values from logger calls and print statements to prevent clear-text exposure of credentials in logs. * fix: address code review feedback on sensitive info redaction - Restore full API key display in Windows fallback banner (masking defeated the purpose of showing the key for the only time) - Revert test helper masking in locust setup (developers need full credentials for load testing) - Add missing await on logger.adebug in agentic_mcp - Remove redundant duplicate log line in openai_responses * fix: replace unnecessary dict comprehension with dict() call --------- Co-authored-by: Janardan Singh Kavia --- src/backend/base/langflow/__main__.py | 2 +- src/backend/base/langflow/api/utils/mcp/agentic_mcp.py | 2 +- src/backend/base/langflow/api/utils/mcp/config_utils.py | 4 ++-- src/backend/base/langflow/api/v1/openai_responses.py | 5 ++--- 4 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/backend/base/langflow/__main__.py b/src/backend/base/langflow/__main__.py index a2beb09e58..7e2c2d6dd2 100644 --- a/src/backend/base/langflow/__main__.py +++ b/src/backend/base/langflow/__main__.py @@ -319,7 +319,7 @@ def run( settings_service.set(arg, values[arg]) elif hasattr(settings_service.auth_settings, arg): settings_service.auth_settings.set(arg, values[arg]) - logger.debug(f"Loading config from cli parameter '{arg}': '{values[arg]}'") + logger.debug("Loading config from cli parameter '%s'", arg) # Get final values from settings host = settings_service.settings.host diff --git a/src/backend/base/langflow/api/utils/mcp/agentic_mcp.py b/src/backend/base/langflow/api/utils/mcp/agentic_mcp.py index 91adfb262e..19f31e741e 100644 --- a/src/backend/base/langflow/api/utils/mcp/agentic_mcp.py +++ b/src/backend/base/langflow/api/utils/mcp/agentic_mcp.py @@ -322,7 +322,7 @@ async def initialize_agentic_user_variables(user_id: UUID | str, session: AsyncS # Create a dict with agentic variable names and default values as empty strings agentic_variables = dict.fromkeys(AGENTIC_VARIABLES, DEFAULT_AGENTIC_VARIABLE_VALUE) - logger.adebug(f"Agentic variables: {agentic_variables}") + await logger.adebug(f"Agentic variables: {list(agentic_variables.keys())}") existing_vars = await variable_service.list_variables(user_id, session) diff --git a/src/backend/base/langflow/api/utils/mcp/config_utils.py b/src/backend/base/langflow/api/utils/mcp/config_utils.py index 7911b74ed1..81a34ea516 100644 --- a/src/backend/base/langflow/api/utils/mcp/config_utils.py +++ b/src/backend/base/langflow/api/utils/mcp/config_utils.py @@ -382,8 +382,8 @@ async def auto_configure_starter_projects_mcp(session): # Set up THIS USER'S starter folder authentication (same as new projects) # If AUTO_LOGIN is false, automatically enable API key authentication default_auth = {"auth_type": "none"} - await logger.adebug(f"Settings service auth settings: {settings_service.auth_settings}") - await logger.adebug(f"User starter folder auth settings: {user_starter_folder.auth_settings}") + await logger.adebug("Settings service auth settings: [REDACTED]") + await logger.adebug("User starter folder auth settings: [REDACTED]") if ( not user_starter_folder.auth_settings and settings_service.auth_settings.AUTO_LOGIN diff --git a/src/backend/base/langflow/api/v1/openai_responses.py b/src/backend/base/langflow/api/v1/openai_responses.py index d9d0ee308d..791bea4bcd 100644 --- a/src/backend/base/langflow/api/v1/openai_responses.py +++ b/src/backend/base/langflow/api/v1/openai_responses.py @@ -74,7 +74,7 @@ async def run_flow_for_openai_responses( context = {} if variables: context["request_variables"] = variables - await logger.adebug(f"Added request variables to context: {variables}") + await logger.adebug(f"Added request variables to context: {list(variables.keys())}") # Convert OpenAI request to SimplifiedAPIRequest # Note: We're moving away from tweaks to a context-based approach @@ -88,7 +88,7 @@ async def run_flow_for_openai_responses( # Context will be passed separately to simple_run_flow - await logger.adebug(f"SimplifiedAPIRequest created with context: {context}") + await logger.adebug(f"SimplifiedAPIRequest created with context keys: {list(context.keys())}") # Use session_id as response_id for OpenAI compatibility response_id = session_id @@ -619,7 +619,6 @@ async def create_response( await logger.adebug(f"All headers received: {list(http_request.headers.keys())}") await logger.adebug(f"Extracted global variables from headers: {list(variables.keys())}") - await logger.adebug(f"Variables dict: {variables}") # Validate tools parameter - error out if tools are provided if request.tools is not None: