From 5513dbf1bbbb4ad28d51a83ba1cbf271ae7ce673 Mon Sep 17 00:00:00 2001 From: Zsolt Parragi Date: Tue, 7 Apr 2026 17:48:10 +0000 Subject: [PATCH] libpq-oauth: Warn when PGOAUTHDEBUG trace may expose secrets PGOAUTHDEBUG trace logging prints raw HTTP traffic, which can include bearer tokens and client secrets. Bracket the trace output with warnings at the start and end of the OAuth flow so users know not to share it. --- src/interfaces/libpq-oauth/oauth-curl.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/interfaces/libpq-oauth/oauth-curl.c b/src/interfaces/libpq-oauth/oauth-curl.c index 9e0d39773e5..517580cd74c 100644 --- a/src/interfaces/libpq-oauth/oauth-curl.c +++ b/src/interfaces/libpq-oauth/oauth-curl.c @@ -3071,6 +3071,11 @@ pg_fe_run_oauth_flow(PGconn *conn, struct PGoauthBearerRequest *request, actx->dbg_num_calls); } + if ((actx->debug_flags & OAUTHDEBUG_UNSAFE_TRACE) + && (result == PGRES_POLLING_OK || result == PGRES_POLLING_FAILED)) + fprintf(stderr, + libpq_gettext("WARNING: PGOAUTHDEBUG trace output above may contain secrets. Do not share with third parties.\n")); + #ifndef WIN32 if (masked) { @@ -3128,6 +3133,11 @@ pg_start_oauthbearer(PGconn *conn, PGoauthBearerRequestV2 *request) */ actx->debug_flags = debug_flags; + + if (actx->debug_flags & OAUTHDEBUG_UNSAFE_TRACE) + fprintf(stderr, + libpq_gettext("WARNING: PGOAUTHDEBUG trace is enabled. HTTP traffic (including secrets) will be logged.\n")); + initPQExpBuffer(&actx->work_data); initPQExpBuffer(&actx->errbuf); -- 2.54.0