Bug: Clear-text logging of sensitive HTTP headers on authentication failure

[Reactivity512]

Location:

• Path: plugin/input/http/http.go
• Function: ServeHTTP
• Line: zap.Any("headers", r.Header) inside if !ok { ... } block (~line 420)

Description

On authentication failure, the entire r.Header map is logged in plaintext:

p.logger.Warn("auth failed",
    zap.String("user_agent", r.UserAgent()),
    zap.Any("headers", r.Header),          //  logs all headers as-is
    zap.String("remote_addr", r.RemoteAddr),
)

r.Header contains the Authorization header (or the custom Auth.Header) with live credentials: Basic <base64>, Bearer <token>, or API keys. These are serialized to JSON by zap.Any and written to logs without masking.

Risk

• Failed auth requests contain the exact credentials just sent by the client; they are persisted in plaintext in logs accessible to operators, SOC, and external log aggregators.

• Token/JWT leakage — even expired or malformed JWTs expose PII in the payload and may be replayable; Bearer tokens and API keys are usable as-is.

• Compliance — violates PCI-DSS, GDPR Article 32, and SOC2 controls for credential storage/protection.

Recommendations:

• Remove zap.Any("headers", r.Header) from the auth-failure log.

• Log only safe metadata:

p.logger.Warn("auth failed",
    zap.String("user_agent", r.UserAgent()),
    zap.String("remote_addr", r.RemoteAddr),
    zap.String("method", r.Method),
    zap.String("uri", r.RequestURI),
    zap.Bool("has_auth", r.Header.Get(p.config.Auth.Header) != ""),
)

• If correlation is needed, log a truncated SHA-256 hash of the auth header instead of the raw value.

References:

CWE-532: Insertion of Sensitive Information into Log File

[spacer07]

Fixed #992