starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-12 04:10:32 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Headscale logs bearer tokens #439

New Issue
Closed
opened 2025-12-29 01:29:21 +01:00 by adam · 13 comments
adam commented 2025-12-29 01:29:21 +01:00
Owner
Copy Link

Originally created by @apollo13 on GitHub (Mar 11, 2023).

Bug description

Looking at the headscale logs, it logs this at info level when accessing the HTTP api:

2023-03-11T21:13:56Z INF unary dur=0.815623 md={":authority":"/var/run/headscale.sock","authorization":"Bearer XXX.XXX","content-type":"application/grpc","grpcgateway-accept":"*/*","grpcgateway-authorization":"Bearer XXX.XXX","grpcgateway-user-agent":"python-httpx/0.23.3","user-agent":"grpc-go/1.51.0","x-forwarded-for":"xxxxx","x-forwarded-host":"xxxxxx"} method=ListApiKeys req={} service=headscale.v1.HeadscaleService

This includes the whole bearer token. It would be great if the credentials wouldn't get logged :)

Originally created by @apollo13 on GitHub (Mar 11, 2023). <!-- Headscale is a multinational community across the globe. Our common language is English. Please consider raising the bug report in this language. --> **Bug description** Looking at the headscale logs, it logs this at info level when accessing the HTTP api: ``` 2023-03-11T21:13:56Z INF unary dur=0.815623 md={":authority":"/var/run/headscale.sock","authorization":"Bearer XXX.XXX","content-type":"application/grpc","grpcgateway-accept":"*/*","grpcgateway-authorization":"Bearer XXX.XXX","grpcgateway-user-agent":"python-httpx/0.23.3","user-agent":"grpc-go/1.51.0","x-forwarded-for":"xxxxx","x-forwarded-host":"xxxxxx"} method=ListApiKeys req={} service=headscale.v1.HeadscaleService ``` This includes the whole bearer token. It would be great if the credentials wouldn't get logged :)
adam added the bug label 2025-12-29 01:29:21 +01:00
adam closed this issue 2025-12-29 01:29:21 +01:00
adam commented 2025-12-29 01:29:22 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Sep 26, 2023):

This issue is stale because it has been open for 180 days with no activity.

@github-actions[bot] commented on GitHub (Sep 26, 2023): This issue is stale because it has been open for 180 days with no activity.
adam commented 2025-12-29 01:29:22 +01:00
Author
Owner
Copy Link

@apollo13 commented on GitHub (Sep 26, 2023):

/unstale

On Tue, Sep 26, 2023, at 03:44, github-actions[bot] wrote:

This issue is stale because it has been open for 180 days with no activity.

—
Reply to this email directly, view it on GitHub
https://github.com/juanfont/headscale/issues/1259#issuecomment-1734701924,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAAT5C5YVREVZA5XN5MXLJLX4IXQDANCNFSM6AAAAAAVXWLR2M.
You are receiving this because you authored the thread.Message ID:
@.***>

@apollo13 commented on GitHub (Sep 26, 2023): /unstale On Tue, Sep 26, 2023, at 03:44, github-actions[bot] wrote: > This issue is stale because it has been open for 180 days with no activity. > > — > Reply to this email directly, view it on GitHub > <https://github.com/juanfont/headscale/issues/1259#issuecomment-1734701924>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAAT5C5YVREVZA5XN5MXLJLX4IXQDANCNFSM6AAAAAAVXWLR2M>. > You are receiving this because you authored the thread.Message ID: > ***@***.***>
adam commented 2025-12-29 01:29:23 +01:00
Author
Owner
Copy Link

@disconn3ct commented on GitHub (Oct 19, 2023):

This is a security exposure, in security software. Is it on the radar for a fix?

@disconn3ct commented on GitHub (Oct 19, 2023): This is a security exposure, in security software. Is it on the radar for a fix?
adam commented 2025-12-29 01:29:23 +01:00
Author
Owner
Copy Link

@almereyda commented on GitHub (Oct 19, 2023):

Would you like to contribute a PR which fixes the perceived regression? I think the maintainers accept contributions again.

The readme clearly states that this is a project for "self-hosters and hobbyists".

If you have specific security requirements, it's probably better to switch to the commercial Tailscale offer.

@almereyda commented on GitHub (Oct 19, 2023): Would you like to contribute a PR which fixes the perceived regression? I think the maintainers accept contributions again. [The readme](https://github.com/juanfont/headscale#design-goal) clearly states that this is a project for "self-hosters and hobbyists". If you have specific security requirements, it's probably better to switch to the commercial Tailscale offer.
adam commented 2025-12-29 01:29:24 +01:00
Author
Owner
Copy Link

@disconn3ct commented on GitHub (Oct 20, 2023):

Is that the official response from the project to this security report? I am more than willing to get it a CVE if that helps.

@disconn3ct commented on GitHub (Oct 20, 2023): Is that the official response from the project to this security report? I am more than willing to get it a CVE if that helps.
adam commented 2025-12-29 01:29:24 +01:00
Author
Owner
Copy Link

@almereyda commented on GitHub (Oct 20, 2023):

This is not an official response, since I am not an official maintainer. This is just how I understand the situation personally.

@almereyda commented on GitHub (Oct 20, 2023): This is not an official response, since I am not an official maintainer. This is just how I understand the situation personally.
adam commented 2025-12-29 01:29:24 +01:00
Author
Owner
Copy Link

@apollo13 commented on GitHub (Oct 20, 2023):

Hi @disconn3ct, also not a maintainer but please don't try to get a CVE. You are apparently operating under the assumption that a project has to live up to certain security standards. This is not necessarily the case (I have no idea what the security policy for headscale is) and no one forces you to use headscale. Threatening to issue a CVE will usually only have the effect of getting completely ignored.

If you want to invest your time productively, you could check if this issue is actually still an issue (I don't know I don't use headscale anymore) and if yes try to come up with a patch.

@apollo13 commented on GitHub (Oct 20, 2023): Hi @disconn3ct, also not a maintainer but please don't try to get a CVE. You are apparently operating under the assumption that a project has to live up to certain security standards. This is not necessarily the case (I have no idea what the security policy for headscale is) and no one forces you to use headscale. Threatening to issue a CVE will usually only have the effect of getting completely ignored. If you want to invest your time productively, you could check if this issue is actually still an issue (I don't know I don't use headscale anymore) and if yes try to come up with a patch.
adam commented 2025-12-29 01:29:25 +01:00
Author
Owner
Copy Link

@disconn3ct commented on GitHub (Oct 20, 2023):

also not a maintainer

and yet here you are, LARPing as one. Maybe you should let the actual maintainers have a chance to respond.

@disconn3ct commented on GitHub (Oct 20, 2023): > also not a maintainer and yet here you are, LARPing as one. Maybe you should let the actual maintainers have a chance to respond.
adam commented 2025-12-29 01:29:25 +01:00
Author
Owner
Copy Link

@disconn3ct commented on GitHub (Nov 11, 2023):

@juanfont fyi https://www.cve.org/CVERecord?id=CVE-2023-47390 was assigned

@disconn3ct commented on GitHub (Nov 11, 2023): @juanfont fyi https://www.cve.org/CVERecord?id=CVE-2023-47390 was assigned
adam commented 2025-12-29 01:29:25 +01:00
Author
Owner
Copy Link

@masterwishx commented on GitHub (Feb 29, 2024):

using v 0.22.3 i have a lot of this when moved to goodieshq/headscale-admin from headscale-ui

@masterwishx commented on GitHub (Feb 29, 2024): using v 0.22.3 i have a lot of this when moved to goodieshq/headscale-admin from headscale-ui
adam commented 2025-12-29 01:29:25 +01:00
Author
Owner
Copy Link

@disconn3ct commented on GitHub (Feb 29, 2024):

Same here. @kradalby can you please reopen this? Or would you prefer a new bug (and new CVE)

headscale-59b8474d86-q55x6 headscale 2024-02-29T14:24:43Z INF unary dur=28.159111 md={":authority":"/var/run/headscale/headscale.sock","authorization":"Bearer OHNO_A_BEARER_TOKEN","content-type":"application/grpc","grpcgateway-accept":"application/json","grpcgateway-accept-language":"en-US,en;q=0.5","grpcgateway-authorization":"Bearer OHNO_ANOTHER!_BEARER_TOKEN","grpcgateway-referer":"https://MY.SITE/admin/nodes/","grpcgateway-user-agent":"Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0","user-agent":"grpc-go/1.54.0","x-forwarded-for":"10.108.0.5, 10.244.2.36","x-forwarded-host":"MY.SITE"} method=ListUsers req={} service=headscale.v1.HeadscaleService

@disconn3ct commented on GitHub (Feb 29, 2024): Same here. @kradalby can you please reopen this? Or would you prefer a new bug (and new CVE) `headscale-59b8474d86-q55x6 headscale 2024-02-29T14:24:43Z INF unary dur=28.159111 md={":authority":"/var/run/headscale/headscale.sock","authorization":"Bearer OHNO_A_BEARER_TOKEN","content-type":"application/grpc","grpcgateway-accept":"application/json","grpcgateway-accept-language":"en-US,en;q=0.5","grpcgateway-authorization":"Bearer OHNO_ANOTHER!_BEARER_TOKEN","grpcgateway-referer":"https://MY.SITE/admin/nodes/","grpcgateway-user-agent":"Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0","user-agent":"grpc-go/1.54.0","x-forwarded-for":"10.108.0.5, 10.244.2.36","x-forwarded-host":"MY.SITE"} method=ListUsers req={} service=headscale.v1.HeadscaleService`
adam commented 2025-12-29 01:29:26 +01:00
Author
Owner
Copy Link

@apollo13 commented on GitHub (Feb 29, 2024):

Folks, read the ticket history. This is fixed and will be part of 0.23.0

@apollo13 commented on GitHub (Feb 29, 2024): Folks, read the ticket history. This is fixed and will be part of 0.23.0
adam commented 2025-12-29 01:29:26 +01:00
Author
Owner
Copy Link

@masterwishx commented on GitHub (Feb 29, 2024):

Folks, read the ticket history. This is fixed and will be part of 0.23.0

Sure, I saw it's fixed in latest prerelease fow now... Sorry for this

@masterwishx commented on GitHub (Feb 29, 2024): > Folks, read the ticket history. This is fixed and will be part of 0.23.0 Sure, I saw it's fixed in latest prerelease fow now... Sorry for this
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#439
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?