Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs #59688
+41
−9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
boring-cyborg
bot
added
area:providers
provider:microsoft-azure
sunank200
force-pushed
the
fix-msgraph-secret-logging
branch
from
a8fafc1 to
8e45f9d
Compare
sunank200
force-pushed
the
fix-msgraph-secret-logging
branch
from
4c4d6a6 to
e6276ea
Compare
uranusjr
reviewed
Dec 22, 2025
providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py
Outdated
Show resolved
Hide resolved
sunank200
force-pushed
the
fix-msgraph-secret-logging
branch
from
e6276ea to
7755235
Compare
amoghrajesh
reviewed
Dec 22, 2025
providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py
Outdated
Show resolved
Hide resolved
providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py
Outdated
Show resolved
Hide resolved
sunank200
force-pushed
the
fix-msgraph-secret-logging
branch
from
23d0833 to
6f78a11
Compare
amoghrajesh
reviewed
Dec 23, 2025
Contributor
amoghrajesh
left a comment
amoghrajesh
left a comment
There was a problem hiding this comment.
We are almost there, one comment
sunank200
force-pushed
the
fix-msgraph-secret-logging
branch
from
9f3db7c to
c33e3e4
Compare
amoghrajesh
reviewed
Dec 23, 2025
providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py
Outdated
Show resolved
Hide resolved
sunank200
force-pushed
the
fix-msgraph-secret-logging
branch
from
3b307d7 to
05525d1
Compare
amoghrajesh
approved these changes
Dec 23, 2025
Contributor
amoghrajesh
left a comment
amoghrajesh
left a comment
There was a problem hiding this comment.
One comment, otherwise LGTM
providers/common/compat/src/airflow/providers/common/compat/sdk.py
Outdated
Show resolved
Hide resolved
potiuk
reviewed
Dec 23, 2025
potiuk
added
the
backport-to-v3-1-test
sunank200
force-pushed
the
fix-msgraph-secret-logging
branch
from
b3cb3da to
39479cd
Compare
text at INFO level.
parameter to automatically mask proxy configurations containing credentials.
Re-export redact from airflow.sdk.log and add to compat module import map to enable unconditional import via airflow.providers.common.compat.sdk
….secrets_masker to the import fallback chain for redact to support compact 3.0.6 and 3.1.5 environments
DEFAULT_SENSITIVE_FIELDS in secrets_masker to ensure proxy configurations are treated as sensitive by default regardless of field naming convention.
sunank200
force-pushed
the
fix-msgraph-secret-logging
branch
from
39479cd to
2c6b2c1
Compare
vatsrahul1001
approved these changes
Dec 24, 2025
Backport failed to create: v3-1-test. View the failure log Run details
You can attempt to backport this manually by running: cherry_picker a9dea6d v3-1-testThis should apply the commit to the v3-1-test branch and leave the commit in conflict state marking After you have resolved the conflicts, you can continue the backport process by running: cherry_picker --continue |
sunank200
added a commit
to astronomer/airflow
that referenced
this pull request
Dec 24, 2025
…ogged in Microsoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688) (cherry picked from commit a9dea6d)
Ankurdeewan
pushed a commit
to Ankurdeewan/airflow
that referenced
this pull request
Dec 25, 2025
…rosoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688)
potiuk
pushed a commit
that referenced
this pull request
Dec 25, 2025
54 tasks
Subham-KRLX
pushed a commit
to Subham-KRLX/airflow
that referenced
this pull request
Jan 2, 2026
…rosoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688)
ephraimbuddy
pushed a commit
that referenced
this pull request
Jan 6, 2026
stegololz
pushed a commit
to stegololz/airflow
that referenced
this pull request
Jan 9, 2026
…rosoft Graph hook logs (apache#59688) Prevent client secrets and proxy credentials from being logged in Microsoft Graph hook logs (apache#59688)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
The
KiotaRequestAdapterHookwas logging sensitive information at INFO level:http://user:pass@proxy.example.com:3128) were logged in plain textFix
DEFAULT_SENSITIVE_FIELDSin the shared secrets_maskerredact(proxies, name="proxies")to automatically mask proxy configurations containing credentialsredact(client_secret, name="client_secret")to mask client secretsTesting
KiotaRequestAdapterHookand following is the screenshot of the task logs:^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named
{pr_number}.significant.rstor{issue_number}.significant.rst, in airflow-core/newsfragments.