Hi Rao,
Yes, I faced the same issue as the sensitive information is passed over
request params. You can configure Tomcat to not log the request params as
below:
In tomcat server.xml, at the end of the file, find the below entry
<valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log." suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
and update it to
<valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log." suffix=".txt"
pattern="%h %l %u %t "%m %U %H" %s %b" />
Hope this helps.
Thanks,
Gandhi Reddy P.
On Thu, Oct 17, 2019 at 5:34 AM Mr Rao <[email protected]> wrote:
> Hi,
>
>
>
> Currently we use CAS for SSO between web applications, now I'm trying to
> use for restful webservices token based authentication using OAuth2/JWT
> tokens.
>
>
>
>
> When I was playing with it I noticed that for accessing token we need to
> pass client_id, client_secret for Grant type client credential and
> username/password for Grant type password as parameters. I think its very
> unsecured because these show up in tomcat access logs.
>
>
>
> Is there any way to pass as part of body or http headers instead of params
> without me override lot of cas code ?
>
>
>
> Thanks
>
>
>
> Rao
>
>
>
>
>
>
>
>
>
>
>
> --
> - Website: https://apereo.github.io/cas
> - Gitter Chatroom: https://gitter.im/apereo/cas
> - List Guidelines: https://goo.gl/1VRrw7
> - Contributions: https://goo.gl/mh7qDG
> ---
> You received this message because you are subscribed to the Google Groups
> "CAS Community" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> To view this discussion on the web visit
> https://groups.google.com/a/apereo.org/d/msgid/cas-user/48a85b67-1292-40c0-ac6c-c514af786687%40apereo.org
> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/48a85b67-1292-40c0-ac6c-c514af786687%40apereo.org?utm_medium=email&utm_source=footer>
> .
>
--
_This mail contains confidential information intended only for the
individual(s) named. If you’re not the named addressee, don’t disseminate,
distribute or copy this e-mail. Please notify the sender immediately and
delete it from your system.If you wish not to receive such e-mails you may
reply with text “Unsubscribe”._
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAAXuvfMpHHiwArXVDz4XcEtSd-aLoWFTiB%3DsUVTq23jvaZ0PAA%40mail.gmail.com.
