Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: `logs.tail` likely fails to redact several credential formats before returning log lines to `operator.read` clients. [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#66832•Fetched 2026-04-15 06:24:13
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
0
Author
ai-hpcai-hpc
Participants
ai-hpcai-hpcMagicray1217Magicray1217
Timeline (top)
labeled ×2commented ×1cross-referenced ×1referenced ×1

logs.tail likely fails to redact several credential and assertion formats before returning log lines to operator.read clients. The current regex-based redaction covers some common token patterns, but it does not clearly cover generic JWTs, X-OpenClaw-Token, x-pomerium-jwt-assertion, or Basic auth headers. If those values appear in logs, logs.tail can expose live secrets or auth assertions to read-scoped clients.

Root Cause

logs.tail likely fails to redact several credential and assertion formats before returning log lines to operator.read clients. The current regex-based redaction covers some common token patterns, but it does not clearly cover generic JWTs, X-OpenClaw-Token, x-pomerium-jwt-assertion, or Basic auth headers. If those values appear in logs, logs.tail can expose live secrets or auth assertions to read-scoped clients.

Fix Action

Fixed

PR fix notes

PR #66896: fix: add redaction patterns for JWT, Basic auth, and custom header tokens

Description (problem / solution / changelog)

Summary

logs.tail gateway method was missing redaction patterns for several credential formats, potentially exposing live secrets to operator.read clients.

Root Cause

The DEFAULT_REDACT_PATTERNS array in src/logging/redact.ts covered Bearer tokens, ENV assignments, JSON fields, and common token prefixes, but did not cover:

  • JWT tokens (eyJ...)
  • Basic auth headers (Authorization: Basic <base64>)
  • Custom header-style tokens (X-OpenClaw-Token, x-pomerium-jwt-assertion, etc.)

Fix

Added 4 new regex patterns to DEFAULT_REDACT_PATTERNS:

  1. JWT token detection (eyJ... three-segment format)
  2. Authorization: Basic header redaction
  3. Bare Basic <base64> pattern
  4. Custom X-header token/assertion/secret patterns

Test Plan

  • Unit tests for new redaction patterns
  • Manual: write log lines with JWT/Basic/custom tokens and verify logs.tail redacts them

Closes openclaw#66832

Changed files

  • src/logging/redact.ts (modified, +7/-0)

Code Example

X-OpenClaw-Token: supersecretgatewaytoken1234567890

---

x-pomerium-jwt-assertion: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.payload.signature

---

Authorization: Basic c2VjcmV0OnBhc3M=

---
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

logs.tail likely fails to redact several credential and assertion formats before returning log lines to operator.read clients. The current regex-based redaction covers some common token patterns, but it does not clearly cover generic JWTs, X-OpenClaw-Token, x-pomerium-jwt-assertion, or Basic auth headers. If those values appear in logs, logs.tail can expose live secrets or auth assertions to read-scoped clients.

Steps to reproduce

  1. Ensure gateway logging is enabled to a readable log file.
  2. Write or trigger a log line containing one of these formats, for example:
X-OpenClaw-Token: supersecretgatewaytoken1234567890

or

x-pomerium-jwt-assertion: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.payload.signature

or

Authorization: Basic c2VjcmV0OnBhc3M=
  1. Connect to the gateway with a client that has operator.read scope.
  2. Call logs.tail.
  3. Inspect the returned lines payload and check whether the sensitive value is fully redacted.

Expected behavior

logs.tail should redact these credential and assertion formats before returning log lines to the client.

Actual behavior

The current default redaction patterns do not clearly cover these formats, so logs.tail may return them insufficiently redacted or fully visible.

OpenClaw version

v2026.4.14-104-g2985cec204

Operating system

Ubuntu 24.04

Install method

No response

Model

Not model specific

Provider / routing chain

client / Control UI / websocket client -> OpenClaw gateway -> logs.tail -> log file read -> redacted lines returned to caller

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

TL;DR

Update the regex-based redaction in logs.tail to cover additional credential and assertion formats, including generic JWTs, X-OpenClaw-Token, x-pomerium-jwt-assertion, and Basic auth headers.

Guidance

  • Review the current regex patterns used for redaction in logs.tail and identify the gaps in coverage for the mentioned formats.
  • Update the redaction logic to include patterns that match X-OpenClaw-Token, x-pomerium-jwt-assertion, and Basic auth headers, in addition to the existing patterns.
  • Test the updated redaction logic with the provided examples to ensure that sensitive values are fully redacted.
  • Consider implementing a more comprehensive redaction strategy that can handle a wide range of credential and assertion formats.

Example

import re

# Existing redaction pattern (example)
existing_pattern = r"Bearer [a-zA-Z0-9._\-]+"

# Updated redaction pattern to cover additional formats
updated_pattern = r"(X-OpenClaw-Token|x-pomerium-jwt-assertion|Authorization: Basic) [a-zA-Z0-9._\-]+"

# Redact log lines using the updated pattern
def redact_log_lines(log_lines):
    redacted_lines = []
    for line in log_lines:
        redacted_line = re.sub(updated_pattern, lambda match: match.group(1) + " <redacted>", line)
        redacted_lines.append(redacted_line)
    return redacted_lines

Notes

The updated redaction pattern should be carefully tested to ensure that it does not introduce any false positives or negatives. Additionally, the redaction logic may need to be reviewed and updated regularly to keep pace with evolving credential and assertion formats.

Recommendation

Apply workaround: Update the regex-based redaction in logs.tail to cover the additional credential and assertion formats, as this will provide an immediate fix for the identified issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

logs.tail should redact these credential and assertion formats before returning log lines to the client.

#API middleware#SSR setup#ISR setup#authentication setup#request error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: `logs.tail` likely fails to redact several credential formats before returning log lines to `operator.read` clients. [1 pull requests, 1 comments, 2 participants]