fix: prevent auth tokens from being logged in cleartext#223
Merged
Conversation
- start-server.ts: Remove auto-generation of auth tokens that were logged in cleartext. Now requires explicit --auth-token or AUTH_TOKEN env var (or --disable-auth) for HTTP transport. - http-client.ts: Remove response data from error logs to prevent potential sensitive data exposure. - proxy.ts: Log only error messages and status codes instead of full error objects, which could contain request headers with auth tokens. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…link Instead of logging the auto-generated HTTP auth token in cleartext, write it to a temp file with restricted permissions (0600). Also resolve the bot ID via /v1/users/me and log a direct link to the Notion integration settings page where users can manage their token. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
hallie
approved these changes
Mar 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses a report of sensitive authorization bearer tokens being logged in cleartext across several files.
Changes
scripts/start-server.ts: Auto-generated HTTP auth tokens are now written to a temp file with restricted permissions (chmod 600) instead of being logged to stdout. On startup, ifNOTION_TOKENis set, the server calls/v1/users/meto resolve the bot ID and logs a direct link to the integration settings page (https://www.notion.so/profile/integrations/internal/{bot_id}) where users can view/manage their Notion API token.src/openapi-mcp-server/client/http-client.ts: Removeddatafield from error logs to prevent potential sensitive data exposure in API error responses.src/openapi-mcp-server/mcp/proxy.ts: Changed error logging to log only error messages and status codes instead of full error objects, which could contain request headers with authorization tokens via axios config.Test plan
--transport http(no--auth-token) and verify token is written to file, not stdout0600permissions--disable-authstill worksNOTION_TOKENresolves bot ID and prints integration link🤖 Generated with Claude Code