Merge pull request #334 from snyk/feat/log-masked-token

feat: Log maskedToken on every server request

lib/log.js

@@ -86,6 +86,9 @@ function sanitiseHeaders(headers) {
   if (hdrs.authorization) {
     hdrs.authorization = '${AUTHORIZATION}';
   }
+  if (hdrs['X-Broker-Token']) {
+    hdrs['X-Broker-Token'] = '${BROKER_TOKEN}';
+  };
   return sanitiseObject(hdrs);
 }
 

lib/relay.js

@@ -8,6 +8,7 @@ const { replace, replaceUrlPartialChunk } = require('./replace-vars');
 const tryJSONParse = require('./try-json-parse');
 const logger = require('./log');
 const version = require('./version');
+const { maskToken } = require('./token');
 const stream = require('stream');
 const NodeCache = require('node-cache');
 
@@ -67,6 +68,7 @@ function requestHandler(filterRules) {
       method: req.method,
       headers: req.headers,
       requestId: req.headers['snyk-request-id'] || uuid(),
+      maskedToken: req.maskedToken,
     };
 
     logger.debug(logContext, 'received request over HTTP connection');
@@ -192,6 +194,7 @@ function responseHandler(filterRules, config, io) {
       headers,
       requestId: headers['snyk-request-id'] || uuid(),
       streamingID,
+      maskedToken: maskToken(brokerToken),
     };
 
     logger.debug(logContext, 'received request over websocket connection');

lib/server/index.js

@@ -2,6 +2,7 @@ const logger = require('../log');
 const socket = require('./socket');
 const relay = require('../relay');
 const version = require('../version');
+const { maskToken } = require('../token');
 const promBundle = require('express-prom-bundle');
 
 module.exports = ({ config = {}, port = null, filters = {} }) => {
@@ -34,7 +35,7 @@ module.exports = ({ config = {}, port = null, filters = {} }) => {
 
   app.get('/connection-status/:token', (req, res) => {
     const token = req.params.token;
-    const maskedToken = token.slice(0, 4) + '-...-' + token.slice(-4);
+    const maskedToken = maskToken(token);
 
     if (connections.has(token)) {
       const clientsMetadata = connections.get(token).map((conn) => ({
@@ -51,7 +52,8 @@ module.exports = ({ config = {}, port = null, filters = {} }) => {
     '/broker/:token/*',
     (req, res, next) => {
       const token = req.params.token;
-      const maskedToken = token.slice(0, 4) + '-...-' + token.slice(-4);
+      const maskedToken = maskToken(token);
+      req.maskedToken = maskedToken;
 
       // check if we have this broker in the connections
       if (!connections.has(token)) {

lib/server/socket.js

@@ -2,6 +2,7 @@ const Primus = require('primus');
 const Emitter = require('primus-emitter');
 const logger = require('../log');
 const relay = require('../relay');
+const { maskToken } = require('../token');
 
 module.exports = ({ server, filters, config }) => {
   const io = new Primus(server, {
@@ -25,7 +26,7 @@ module.exports = ({ server, filters, config }) => {
 
     const close = (closeReason = 'none') => {
       if (token) {
-        const maskedToken = token.slice(0, 4) + '-...-' + token.slice(-4);
+        const maskedToken = maskToken(token);
         const clientPool = connections
           .get(token)
           .filter((_) => _.socket !== socket);
@@ -67,7 +68,7 @@ module.exports = ({ server, filters, config }) => {
         return;
       }
 
-      const maskedToken = token.slice(0, 4) + '-...-' + token.slice(-4);
+      const maskedToken = maskToken(token);
 
       logger.info(
         { maskedToken, metadata: clientData.metadata },

lib/token.js

@@ -0,0 +1,11 @@
+module.exports = {
+  maskToken,
+};
+
+function maskToken(token) {
+  if (!token || token === "") {
+    return "";
+  }
+
+  return token.slice(0, 4) + '-...-' + token.slice(-4);
+}