security: redact authentication tokens from tracing logs

src/bin/stdio.rs

@@ -1,5 +1,6 @@
 use anyhow::Result;
 use common::trustify::Trustify;
+use mcp::logging::RedactingFields;
 use rmcp::{ServiceExt, transport::stdio};
 use tracing_subscriber::{self, EnvFilter};
 
@@ -9,7 +10,8 @@ mod common;
 async fn main() -> Result<()> {
     // Initialize the tracing subscriber with file and stdout logging
     tracing_subscriber::fmt()
-        .with_env_filter(EnvFilter::from_default_env().add_directive(tracing::Level::DEBUG.into()))
+        .with_env_filter(EnvFilter::from_default_env().add_directive(tracing::Level::INFO.into()))
+        .fmt_fields(RedactingFields)
         .with_writer(std::io::stderr)
         .with_ansi(false)
         .init();

src/bin/streamhttp.rs

@@ -1,4 +1,5 @@
 use mcp::auth;
+use mcp::logging::RedactingFields;
 use rmcp::transport::streamable_http_server::{
     StreamableHttpService, session::local::LocalSessionManager,
 };
@@ -17,9 +18,9 @@ async fn main() -> anyhow::Result<()> {
     tracing_subscriber::registry()
         .with(
             tracing_subscriber::EnvFilter::try_from_default_env()
-                .unwrap_or_else(|_| "debug".to_string().into()),
+                .unwrap_or_else(|_| "info".to_string().into()),
         )
-        .with(tracing_subscriber::fmt::layer())
+        .with(tracing_subscriber::fmt::layer().fmt_fields(RedactingFields))
         .init();
 
     let service = StreamableHttpService::new(

src/lib.rs

@@ -1 +1,2 @@
 pub mod auth;
+pub mod logging;

src/logging.rs

@@ -0,0 +1,121 @@
+use std::fmt;
+
+use tracing_subscriber::{
+    field::{RecordFields, Visit, VisitOutput},
+    fmt::{
+        FormattedFields,
+        format::{DefaultVisitor, FormatFields, Writer},
+    },
+};
+
+const REDACTED: &str = "[REDACTED]";
+
+#[derive(Debug, Default)]
+pub struct RedactingFields;
+
+impl<'writer> FormatFields<'writer> for RedactingFields {
+    fn format_fields<R: RecordFields>(&self, writer: Writer<'writer>, fields: R) -> fmt::Result {
+        let mut visitor = RedactingVisitor {
+            inner: DefaultVisitor::new(writer, true),
+        };
+        fields.record(&mut visitor);
+        visitor.finish()
+    }
+
+    fn add_fields(
+        &self,
+        current: &mut FormattedFields<Self>,
+        fields: &tracing::span::Record<'_>,
+    ) -> fmt::Result {
+        let is_empty = current.fields.is_empty();
+        if !is_empty {
+            current.fields.push(' ');
+        }
+
+        let mut visitor = RedactingVisitor {
+            inner: DefaultVisitor::new(current.as_writer(), is_empty),
+        };
+        fields.record(&mut visitor);
+        visitor.finish()
+    }
+}
+
+struct RedactingVisitor<'writer> {
+    inner: DefaultVisitor<'writer>,
+}
+
+impl Visit for RedactingVisitor<'_> {
+    fn record_debug(&mut self, field: &tracing::field::Field, value: &dyn fmt::Debug) {
+        if is_sensitive_field(field.name()) {
+            self.inner.record_debug(field, &REDACTED);
+        } else {
+            self.inner.record_debug(field, value);
+        }
+    }
+}
+
+impl VisitOutput<fmt::Result> for RedactingVisitor<'_> {
+    fn finish(self) -> fmt::Result {
+        self.inner.finish()
+    }
+}
+
+fn is_sensitive_field(name: &str) -> bool {
+    name.eq_ignore_ascii_case("authorization")
+        || name.eq_ignore_ascii_case("token")
+        || name.eq_ignore_ascii_case("access_token")
+        || name.eq_ignore_ascii_case("bearer")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::RedactingFields;
+    use std::{
+        io::{self, Write},
+        sync::{Arc, Mutex},
+    };
+
+    #[derive(Clone)]
+    struct SharedWriter(Arc<Mutex<Vec<u8>>>);
+
+    impl Write for SharedWriter {
+        fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+            self.0.lock().unwrap().write(bytes)
+        }
+
+        fn flush(&mut self) -> io::Result<()> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn sensitive_fields_are_redacted() {
+        let output = Arc::new(Mutex::new(Vec::new()));
+        let subscriber = tracing_subscriber::fmt()
+            .with_max_level(tracing::Level::DEBUG)
+            .fmt_fields(RedactingFields)
+            .with_ansi(false)
+            .with_writer({
+                let output = Arc::clone(&output);
+                move || SharedWriter(Arc::clone(&output))
+            })
+            .finish();
+
+        tracing::subscriber::with_default(subscriber, || {
+            let span = tracing::debug_span!(
+                "authenticate",
+                token = "bearer-token",
+                authorization = "Bearer bearer-token",
+                request_id = "safe-value"
+            );
+            let _entered = span.enter();
+            tracing::debug!("request received");
+        });
+
+        let output = String::from_utf8(output.lock().unwrap().clone()).unwrap();
+        assert!(!output.contains("bearer-token"));
+        assert!(output.contains("token=\"[REDACTED]\""));
+        assert!(output.contains("authorization=\"[REDACTED]\""));
+        assert!(output.contains("request_id=\"safe-value\""));
+    }
+}