fix: remove OAuth token logging and redact sensitive data from CLI output

Remove unconditional log.Printf calls that leaked access tokens and
refresh tokens to stderr after SSO login. Redact the callback URL
(which contained the OAuth authorization code) and the authorization
URL (which contained state nonce and code challenge).

Additionally, add redaction of Authorization headers and OAuth token
parameters in verbose HTTP dump output to prevent credential exposure
when --verbose flag is used.

Closes #449

Author: gyanranjanpanda

cmd/login.go

@@ -219,7 +219,7 @@ func oauth2login(
 	// Authorization redirect callback from OAuth2 auth flow.
 	// Handles both implicit and authorization code flow
 	callbackHandler := func(w http.ResponseWriter, r *http.Request) {
-		log.Printf("Callback: %s\n", r.URL)
+		log.Printf("Callback received on: %s\n", r.URL.Path)
 
 		if formErr := r.FormValue("error"); formErr != "" {
 			handleErr(w, fmt.Sprintf("%s: %s", formErr, r.FormValue("error_description")))
@@ -276,7 +276,8 @@ func oauth2login(
 	opts = append(opts, oauth2.SetAuthURLParam("code_challenge_method", "S256"))
 	url = oauth2conf.AuthCodeURL(stateNonce, opts...)
 
-	fmt.Printf("Performing %s flow login: %s\n", "authorization_code", url)
+	authBaseURL := strings.SplitN(url, "?", 2)[0]
+	fmt.Printf("Performing %s flow login: %s\n", "authorization_code", authBaseURL)
 	time.Sleep(1 * time.Second)
 	ssoAuthFlow(url, ssoLaunchBrowser)
 	go func() {
@@ -293,8 +294,7 @@ func oauth2login(
 	ctx, cancel := context.WithTimeout(ctx, 1*time.Second)
 	defer cancel()
 	_ = srv.Shutdown(ctx)
-	log.Printf("Token: %s\n", tokenString)
-	log.Printf("Refresh Token: %s\n", refreshToken)
+
 	return tokenString, refreshToken
 }
 

pkg/config/config.go

@@ -23,7 +23,8 @@ import (
 	"net/http/httputil"
 	"os"
 	"path/filepath"
-	strings "strings"
+	"regexp"
+	"strings"
 )
 
 var (
@@ -37,6 +38,13 @@ var (
 	ConfigPath = filepath.Join(os.Getenv("HOME"), ".microcks-cli", "config.yaml")
 )
 
+var sensitiveHeaderPattern = regexp.MustCompile(
+	`(?im)^(Authorization:\s*)(Bearer\s+)?(.+)$`,
+)
+var sensitiveParamPattern = regexp.MustCompile(
+	`(?i)(access_token|refresh_token|id_token|code)=([^&\s]+)`,
+)
+
 // CreateTLSConfig wraps the creation of tls.Config object for use with HTTP Client for example.
 func CreateTLSConfig() *tls.Config {
 	tlsConfig := &tls.Config{}
@@ -76,7 +84,7 @@ func DumpRequestIfRequired(name string, req *http.Request, body bool) {
 		if err != nil {
 			fmt.Println("Got error while dumping request out")
 		}
-		fmt.Printf("%s", dump)
+		fmt.Printf("%s", redactSensitiveContent(string(dump)))
 	}
 }
 
@@ -88,9 +96,16 @@ func DumpResponseIfRequired(name string, resp *http.Response, body bool) {
 		if err != nil {
 			fmt.Println("Got error while dumping response")
 		}
-		fmt.Printf("%s", dump)
+		fmt.Printf("%s", redactSensitiveContent(string(dump)))
 		if body {
 			fmt.Println("")
 		}
 	}
 }
+
+// redactSensitiveContent masks OAuth tokens and credentials in HTTP dump output.
+func redactSensitiveContent(dump string) string {
+	redacted := sensitiveHeaderPattern.ReplaceAllString(dump, "${1}[REDACTED]")
+	redacted = sensitiveParamPattern.ReplaceAllString(redacted, "${1}=[REDACTED]")
+	return redacted
+}