Fix sensitive data written to a log in Next.js

A password, token, cookie, or similar value is passed to a log sink. Centralised logs are widely readable inside an organisation and often retained for months - a credential that lands there is a credential that has left the application's control.

medium likely Next.js CWE-532 / OWASP A09:2021

The vulnerable pattern in Next.js

MEDIUM likely Sensitive data written to a log A09:2021 app/api/users/route.ts:11:18 9 │ export async function GET(request: Request) { 10 │ // sensitive-data-logged: the Authorization header lands in the log aggregator. 11 │ console.info({ authorization: request.headers.get('authorization') }) │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sensitive value written to a log 12 │ // sensitive-data-logged: the caller's access token, logged the same way. 13 │ const accessToken = request.headers.get('x-access-token')

This finding comes from the Next.js fixture in the owlwarden test suite, in /api/users. Logs are copied into aggregators, retained for months, and readable by anyone with access to the logging system. A credential that reaches a log has left the application's trust boundary.

The corrected handler

Log that the attempt happened, not the credential.

console.info({ event: 'login_attempt', userId })
// never: console.info({ password })

If you are not using Next.js

Log a redacted shape - an id, a boolean, a length - never the secret itself.

Check your own repository

npx owlwarden scan
npx owlwarden explain sensitive-data-logged

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Next.js checks

Rules with a tested Next.js example.

sensitive-data-logged for every framework / All rules / owlwarden