From 19269185635ab4470de60ef1c828a43a13ed0fe4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Graber?= Date: Fri, 31 Jul 2026 17:26:07 -0400 Subject: [PATCH] shared/api: Hide additional sensitive config keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Stéphane Graber --- shared/api/server.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/shared/api/server.go b/shared/api/server.go index 180ef35668..7d62263e35 100644 --- a/shared/api/server.go +++ b/shared/api/server.go @@ -1,6 +1,7 @@ package api import ( + "slices" "strings" "go.yaml.in/yaml/v4" @@ -228,10 +229,15 @@ func (srv *Server) Writable() ServerPut { // isConfigKeySensitive is used to check if a given configuration key is likely to be sensitive and should be censored. func isConfigKeySensitive(key string) bool { + // Sensitive keys that aren't covered by the suffix check. + if slices.Contains([]string{"acme.eab.kid", "acme.provider.environment", "oidc.client.id"}, key) { + return true + } + fields := strings.Split(key, ".") segment := fields[len(fields)-1] - for _, suffix := range []string{"key", "cert", "password", "secret", "token"} { + for _, suffix := range []string{"key", "cert", "hmac", "password", "secret", "token"} { if strings.HasSuffix(segment, suffix) { return true }