Skip to content

Commit 40da9fb

Browse files
pavelzemanclaude
andcommitted
fix: log warning when bearer token is sanitized
Address review feedback from @Willyfrog: log when sanitizedToken differs from the original so corrupted tokens are visible in logs for debugging, without exposing the token value itself. Co-authored-by: Claude <claude@anthropic.com>
1 parent 9b71334 commit 40da9fb

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

android/src/main/java/com/mattermost/networkclient/interceptors/BearerTokenInterceptor.kt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package com.mattermost.networkclient.interceptors
22

3+
import android.util.Log
34
import com.mattermost.networkclient.ApiClientModuleImpl
45
import okhttp3.Interceptor
56
import okhttp3.Response
@@ -16,6 +17,9 @@ class BearerTokenInterceptor(private val alias: String, private val bearerAuthTo
1617
// Corrupted tokens with control characters (e.g. 0x02) cause OkHttp to throw
1718
// IllegalArgumentException when setting the Authorization header.
1819
val sanitizedToken = token.replace(Regex("[^\\x20-\\x7E]"), "")
20+
if (sanitizedToken != token) {
21+
Log.w("BearerTokenInterceptor", "Bearer token contained non-ASCII characters and was sanitized (removed ${token.length - sanitizedToken.length} chars)")
22+
}
1923
if (sanitizedToken.isNotEmpty()) {
2024
request = request.newBuilder()
2125
.header("Authorization", "Bearer $sanitizedToken")

0 commit comments

Comments
 (0)