From d405a5df353d18f60fa48cb67371316c363c03e4 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Fri, 2 Jan 2026 20:26:55 -0800 Subject: [PATCH] refactor: Surface credential generation errors and remove sensitive logging Two improvements to error handling and security: 1. weed/iam/sts/session_claims.go: - Add logging for credential generation failures in ToSessionInfo() - Wrap errors with context (session ID) to aid debugging - Use glog.Warningf() to surface errors instead of silently swallowing them - Add fmt import for error wrapping 2. weed/s3api/auth_signature_v4.go: - Remove debug logging of actual access key IDs (glog.V(2) call) - Security improvement: avoid exposing sensitive access keys even at debug level - Keep warning-level logging that shows only count of available keys This ensures credential generation failures are observable while protecting sensitive authentication material from logs. --- weed/iam/sts/session_claims.go | 8 ++++++-- weed/s3api/auth_signature_v4.go | 5 ----- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/weed/iam/sts/session_claims.go b/weed/iam/sts/session_claims.go index a44247daf..b57075bb4 100644 --- a/weed/iam/sts/session_claims.go +++ b/weed/iam/sts/session_claims.go @@ -1,9 +1,11 @@ package sts import ( + "fmt" "time" "github.com/golang-jwt/jwt/v5" + "github.com/seaweedfs/seaweedfs/weed/glog" ) // defaultCredentialGenerator is a reusable instance for generating temporary credentials @@ -72,8 +74,10 @@ func (c *STSSessionClaims) ToSessionInfo() *SessionInfo { // This is deterministic based on the session ID, so the same credentials are regenerated credentials, err := defaultCredentialGenerator.GenerateTemporaryCredentials(c.SessionId, expiresAt) if err != nil { - // If credential generation fails, return session info without credentials - // The validation code will catch this as invalid credentials + // Log the error with context - credential generation failure is important for debugging + errMsg := fmt.Errorf("generate temporary credentials for session %s: %w", c.SessionId, err) + glog.Warningf("Failed to generate credentials for STS session: %v", errMsg) + // Return session info without credentials - validation will catch this as invalid credentials = nil } diff --git a/weed/s3api/auth_signature_v4.go b/weed/s3api/auth_signature_v4.go index f769a1d39..18367aa81 100644 --- a/weed/s3api/auth_signature_v4.go +++ b/weed/s3api/auth_signature_v4.go @@ -234,11 +234,6 @@ func (iam *IdentityAccessManagement) verifyV4Signature(r *http.Request, shouldCh glog.Warningf("InvalidAccessKeyId: attempted key '%s' not found. Available keys: %d, Auth enabled: %v", authInfo.AccessKey, len(availableKeys), iam.isAuthEnabled) - if glog.V(2) && len(availableKeys) > 0 { - glog.V(2).Infof("Available access keys: %v", availableKeys) - } - - return nil, nil, "", nil, s3err.ErrInvalidAccessKeyID } // Check service account expiration