From b93cf20cbcd667f7a011bcc62daef5770fb6db71 Mon Sep 17 00:00:00 2001
From: liuhy <liuhongyu@apache.org>
Date: Mon, 3 Aug 2026 17:40:50 -0700
Subject: [PATCH] fix: redact authentication signatures in audit logs

---
 .../DefaultAuthenticationProvider.java        | 20 +++++++++-
 .../DefaultAuthenticationProviderTest.java    | 40 +++++++++++++++++++
 2 files changed, 58 insertions(+), 2 deletions(-)
 create mode 100644 auth/src/test/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProviderTest.java

diff --git a/auth/src/main/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProvider.java b/auth/src/main/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProvider.java
index 98e7ede7ee3..cafc12f7a32 100644
--- a/auth/src/main/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProvider.java
+++ b/auth/src/main/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProvider.java
@@ -35,6 +35,9 @@
 
 public class DefaultAuthenticationProvider implements AuthenticationProvider<DefaultAuthenticationContext> {
 
+    private static final int SIGNATURE_VISIBLE_CHARS = 4;
+    private static final String REDACTED_SIGNATURE = "****";
+
     protected final Logger log = LoggerFactory.getLogger(LoggerName.ROCKETMQ_AUTH_AUDIT_LOGGER_NAME);
     protected AuthConfig authConfig;
     protected Supplier<?> metadataService;
@@ -72,10 +75,23 @@ protected void doAuditLog(DefaultAuthenticationContext context, Throwable ex) {
         if (StringUtils.isBlank(context.getUsername())) {
             return;
         }
+        String signature = maskSignature(context.getSignature());
         if (ex != null) {
-            log.info("[AUTHENTICATION] User:{} is authenticated failed with Signature = {}.", context.getUsername(), context.getSignature());
+            log.info("[AUTHENTICATION] User:{} is authenticated failed with Signature = {}.", context.getUsername(), signature);
         } else {
-            log.debug("[AUTHENTICATION] User:{} is authenticated success with Signature = {}.", context.getUsername(), context.getSignature());
+            log.debug("[AUTHENTICATION] User:{} is authenticated success with Signature = {}.", context.getUsername(), signature);
+        }
+    }
+
+    static String maskSignature(String signature) {
+        if (StringUtils.isBlank(signature)) {
+            return REDACTED_SIGNATURE;
+        }
+        if (signature.length() <= SIGNATURE_VISIBLE_CHARS * 2) {
+            return REDACTED_SIGNATURE;
         }
+        return signature.substring(0, SIGNATURE_VISIBLE_CHARS)
+            + REDACTED_SIGNATURE
+            + signature.substring(signature.length() - SIGNATURE_VISIBLE_CHARS);
     }
 }
diff --git a/auth/src/test/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProviderTest.java b/auth/src/test/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProviderTest.java
new file mode 100644
index 00000000000..a973b5c5115
--- /dev/null
+++ b/auth/src/test/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProviderTest.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.auth.authentication.provider;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class DefaultAuthenticationProviderTest {
+
+    @Test
+    public void maskSignatureShouldRedactShortSignatures() {
+        Assert.assertEquals("****", DefaultAuthenticationProvider.maskSignature("test"));
+        Assert.assertEquals("****", DefaultAuthenticationProvider.maskSignature("abcd1234"));
+        Assert.assertEquals("****", DefaultAuthenticationProvider.maskSignature(null));
+    }
+
+    @Test
+    public void maskSignatureShouldKeepOnlyPrefixAndSuffix() {
+        String signature = "DJRRXBXlCVuKh6ULoN87847QX+Y=";
+
+        String masked = DefaultAuthenticationProvider.maskSignature(signature);
+
+        Assert.assertEquals("DJRR****X+Y=", masked);
+        Assert.assertFalse(masked.contains("XBXlCVuKh6ULoN87847Q"));
+    }
+}