Master gateway error log#1371
Conversation
Gateway Error Logging to Kafka
pass the reponse body in the error log to the topic
📝 WalkthroughWalkthroughThe gateway's ChangesGateway error event logging
Estimated code review effort: 2 (Simple) | ~15 minutes Sequence Diagram(s)sequenceDiagram
participant ErrorFilter
participant ExceptionUtils
participant Producer
participant Kafka
ErrorFilter->>ExceptionUtils: raiseErrorFilterException(exchange, e)
ExceptionUtils->>ExceptionUtils: _setExceptionBody(exchange, e)
ExceptionUtils->>ExceptionUtils: pushErrorEvent(exchange, e)
alt errorLogEnabled and not blacklisted
ExceptionUtils->>ExceptionUtils: build EventLogRequest
ExceptionUtils->>Producer: send(errorLogTopic, EventLogRequest)
Producer->>Kafka: publish message
else disabled or blacklisted
ExceptionUtils-->>ExceptionUtils: skip publishing
end
ExceptionUtils-->>ErrorFilter: write response body
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@core-services/gateway/src/main/java/com/example/gateway/utils/ExceptionUtils.java`:
- Around line 44-45: The blacklist parsing in ExceptionUtils currently leaves
entries untrimmed and the error logging flow in pushErrorEvent still captures
sensitive data by default for any non-blacklisted URL. Update the `@Value-backed`
errorLogUrlsBlacklist handling so each comma-separated prefix is trimmed before
use, and adjust the pushErrorEvent path to avoid blindly including
queryParams/responseBody for sensitive endpoints unless explicitly allowed. Use
the existing ExceptionUtils and pushErrorEvent symbols to locate the logic.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: faa7ff12-2447-4ce9-85d2-9ec65c68e539
📒 Files selected for processing (4)
core-services/gateway/src/main/java/com/example/gateway/filters/error/ErrorFilter.javacore-services/gateway/src/main/java/com/example/gateway/model/EventLogRequest.javacore-services/gateway/src/main/java/com/example/gateway/utils/ExceptionUtils.javacore-services/gateway/src/main/resources/application.properties
| @Value("#{'${errorlog.urls.blacklist:}'.split(',')}") | ||
| private List<String> errorLogUrlsBlacklist; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Opt-out blacklist defaults to "capture everything," risking sensitive data leaking into Kafka.
errorLogUrlsBlacklist defaults to empty (also confirmed by application.properties comment: "Empty = capture all"), and pushErrorEvent unconditionally captures queryParams (Line 129) and the full error responseBody (Line 136) for every non-blacklisted path once errorlog.enabled=true. The application's own egov.open-endpoints-whitelist list includes auth-sensitive endpoints (e.g. /user/oauth/token, /otp/v1/_validate, /user-otp/v1/_send), whose query params could carry tokens/OTPs. Since the model is opt-out rather than opt-in (unlike eventlog.urls.whitelist used for regular event logging), an admin who enables error logging without curating the blacklist will unintentionally persist sensitive request data to a Kafka topic.
Consider defaulting to redacting/omitting queryParams for known sensitive prefixes, or switching to an opt-in whitelist model consistent with the existing eventlog.urls.whitelist pattern.
Separately, blacklist prefixes aren't trimmed — a value like "/a, /b" yields " /b" as a prefix, which will never match /b... paths, silently breaking blacklist entries.
💡 Proposed fix for prefix trimming
- boolean blacklisted = errorLogUrlsBlacklist.stream()
- .anyMatch(prefix -> !prefix.isEmpty() && requestPath.startsWith(prefix));
+ boolean blacklisted = errorLogUrlsBlacklist.stream()
+ .map(String::trim)
+ .anyMatch(prefix -> !prefix.isEmpty() && requestPath.startsWith(prefix));Also applies to: 108-144
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@core-services/gateway/src/main/java/com/example/gateway/utils/ExceptionUtils.java`
around lines 44 - 45, The blacklist parsing in ExceptionUtils currently leaves
entries untrimmed and the error logging flow in pushErrorEvent still captures
sensitive data by default for any non-blacklisted URL. Update the `@Value-backed`
errorLogUrlsBlacklist handling so each comma-separated prefix is trimmed before
use, and adjust the pushErrorEvent path to avoid blindly including
queryParams/responseBody for sensitive endpoints unless explicitly allowed. Use
the existing ExceptionUtils and pushErrorEvent symbols to locate the logic.
3 participants
Summary by CodeRabbit
New Features
Bug Fixes