- Shipped
- September 23, 2026 at 10:16 AM UTC
- Author
- Kamo
- Commit
- 3e5793d
forward() printed the entire copied-header map on every single call -- System.out.println("APIService: copied headers: " + outHeaders) -- which serializes X-***-Token, Cookie, X-OTK and Authorization in full, plus a separate line with a 32-character *** prefix. Combined with org.springframework.web at DEBUG in the ConfigMap (Spring MVC logs request headers of its own at that level), live logs held 32 *** tokens and 52 X-OTK values in one 30-minute window. This gateway is the platform's single chokepoint for every /api/** call, so that was continuous exposure of tenant session material in a place nothing can redact after the fact. Removed all ~31 System.out.println calls (and one printStackTrace) from APIGatewayController -- roughly 15-20 ran per request, which was also a throughput tax on the busiest service on the platform. The two exception paths in forward() now log at most one WARN line each, naming the method, URI and status/exception message -- never a header map or a body. org.springframework.web is WARN in both k8s/config.yaml (what the cluster actually reads) and **************** (what a local run reads). CredentialLoggingTest drives a real forwarded request carrying all four credential shapes and asserts nothing at all reaches System.out; reverting the header-dump println fails it immediately.