Basic Auth Decode adds source to the trace
I have a proxy with the following BasicAuthentication policy
<BasicAuthentication name="Basic-Authentication">
<DisplayName>Basic Authentication</DisplayName>
<Operation>Decode</Operation>
<IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
<User ref="private.request.header.username"/>
<Password ref="private.request.header.password"/>
<Source>request.header.Authorization</Source>
</BasicAuthentication>
When I trace this proxy the request.header.Authrorization variable gets added to the trace as a variable. The Authorization header is masked in the Headers section but it shows up in the variables section. I was just wondering if that is by design or if it was overlooked. I think the source for the basic auth policy should never show up in the trace. The work around for me would be to mask the field but it would be much better if this was just solved for the policy in general.
Hmmm, that sounds like a bug to me, Daniel. Let me look into it further.
Best Answer
Answer by Dino-at-Google
·
Jun 19, 2018 at 10:02 PM
Daniel, I've raised a ticket (b/110429629) to have this fixed.
Hey Dino, we are having the same problem, and I was wondering if this has been addressed? I can't find the bug number...
This problem was fixed back in 2018. What version of Apigee are you using?
In general when I post a bug reference, people here won't be able to directly access the bug database; that number is an internal reference. You can contact Apigee support and inquire about the status, though.
Dino, our Dev version is Version 4.50.00.00. How was the bug fixed? Is there configuration that needs to be done or does Apigee no longer add the auth header as an internal variable that becomes visible during trace?
During an assign message policy when the auth header gets set, Apigee is adding this message.header.Authorization variable to the trace and the base64 encoded auth string is getting displayed.
