{"action":"created","issue":{"url":"https://api.github.com/repos/google/go-github/issues/169","labels_url":"https://api.github.com/repos/google/go-github/issues/169/labels{/name}","comments_url":"https://api.github.com/repos/google/go-github/issues/169/comments","events_url":"https://api.github.com/repos/google/go-github/issues/169/events","html_url":"https://github.com/google/go-github/issues/169","id":60774328,"number":169,"title":"OAuth token leakage in error messages","user":{"login":"AustinDizzy","id":2718133,"avatar_url":"https://avatars.githubusercontent.com/u/2718133?v=3","gravatar_id":"","url":"https://api.github.com/users/AustinDizzy","html_url":"https://github.com/AustinDizzy","followers_url":"https://api.github.com/users/AustinDizzy/followers","following_url":"https://api.github.com/users/AustinDizzy/following{/other_user}","gists_url":"https://api.github.com/users/AustinDizzy/gists{/gist_id}","starred_url":"https://api.github.com/users/AustinDizzy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AustinDizzy/subscriptions","organizations_url":"https://api.github.com/users/AustinDizzy/orgs","repos_url":"https://api.github.com/users/AustinDizzy/repos","events_url":"https://api.github.com/users/AustinDizzy/events{/privacy}","received_events_url":"https://api.github.com/users/AustinDizzy/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-03-12T05:41:11Z","updated_at":"2015-03-15T16:09:27Z","closed_at":null,"body":"OAuth tokens are leaked in Go errors. The errors contain the full URL which contains `client_id` and `client_secret` and can be leaked to a user or easily passed on to someone who shouldn't see it.\r\n\r\nShouldn't it be sanitized from the URL - basically just remove the `client_id` and `client_secret` fields and their respective values from the error string - to prevent those from being leaked to an end-user?\r\n\r\n**Before:** `Get https://api.github.com/user/:username/repos?sort=created&client_id=test1234&client_secret=1234test: 404 Not Found []`.\r\n\r\n**After:** `Get https://api.github.com/user/:username/repos?sort=created: 404 Not Found []`.\r\n\r\nI have a basic solution that I'm about to commit and submit as a pull request. It simply removes those fields and their values from the error text. It satisfies the before/after clause detailed above."},"comment":{"url":"https://api.github.com/repos/google/go-github/issues/comments/81130337","html_url":"https://github.com/google/go-github/issues/169#issuecomment-81130337","issue_url":"https://api.github.com/repos/google/go-github/issues/169","id":81130337,"user":{"login":"pengwynn","id":865,"avatar_url":"https://avatars.githubusercontent.com/u/865?v=3","gravatar_id":"","url":"https://api.github.com/users/pengwynn","html_url":"https://github.com/pengwynn","followers_url":"https://api.github.com/users/pengwynn/followers","following_url":"https://api.github.com/users/pengwynn/following{/other_user}","gists_url":"https://api.github.com/users/pengwynn/gists{/gist_id}","starred_url":"https://api.github.com/users/pengwynn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pengwynn/subscriptions","organizations_url":"https://api.github.com/users/pengwynn/orgs","repos_url":"https://api.github.com/users/pengwynn/repos","events_url":"https://api.github.com/users/pengwynn/events{/privacy}","received_events_url":"https://api.github.com/users/pengwynn/received_events","type":"User","site_admin":true},"created_at":"2015-03-15T16:09:27Z","updated_at":"2015-03-15T16:09:27Z","body":"No update, but better app-level authentication is on the radar. As a workaround, most clients opt for a scope-less token for these type of scenarios."}}