Security: fix secret leakage in errors.

permitio · Oct 2, 2023 · 062dbee · 062dbee
1 parent 3afcd1a
commit 062dbee
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/packages/opal-common/opal_common/authentication/deps.py b/packages/opal-common/opal_common/authentication/deps.py
@@ -32,11 +32,11 @@ def verify_logged_in(verifier: JWTVerifier, token: Optional[str]) -> JWTClaims:
             logger.debug("JWT verification disabled, cannot verify requests!")
             return {}
         if token is None:
-            raise Unauthorized(token=token, description="access token was not provided")
+            raise Unauthorized(description="access token was not provided")
         claims: JWTClaims = verifier.verify(token)
         subject = claims.get("sub", "")
 
-        invalid = Unauthorized(token=token, description="invalid sub claim")
+        invalid = Unauthorized(description="invalid sub claim")
         if not subject:
             raise invalid
         try: