Sensitive data written to a log
A password, token, cookie, or similar value is passed to a log sink. Centralised logs are widely readable inside an organisation and often retained for months - a credential that lands there is a credential that has left the application's control.
medium likely application source OWASP A09:2021 / CWE-532
What it looks like
MEDIUM likely Sensitive data written to a log A09:2021
app/api/users/route.ts:11:18
9 │ export async function GET(request: Request) {
10 │ // sensitive-data-logged: the Authorization header lands in the log aggregator.
11 │ console.info({ authorization: request.headers.get('authorization') })
│ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sensitive value written to a log
12 │ // sensitive-data-logged: the caller's access token, logged the same way.
13 │ const accessToken = request.headers.get('x-access-token')
From app/api/users/route.ts in the fixture suite.
The fixture test asserts this finding.
How to fix it
Log a redacted shape - an id, a boolean, a length - never the secret itself.
The fix for your framework
Choose the API used by your project.
- Next.js
- Nuxt
- NestJS
- Express
- Fastify
- Hono
- Koa
- Hapi
- Sails.js
- Astro
- Remix
- Gatsby
- SvelteKit
- TanStack Start
- SolidStart
- Elysia
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain sensitive-data-logged
explain prints the rule and fixes in the terminal. It does not
use the network.