Hi pact_broker team,
I faced some problem when I tried to use the webhook to trigger the pipeline of Gitlab.
Due to the internal restriction, rather than Project access token, I was only abled to use Pipeline trigger token, which is only allowed to be added into the request body like "token": {Pipeline-trigger-token}, not the promising request header.
Fortunately(or of course), it do trigger the pipeline at the currect timing as we wished.
While the problem is that the token added into the reqeust body wasn't masked as the one in added into the request header and the token has been shown in plaintext in the webhook setting or the webhook logs of Pact Broker, which may induce security concern.
It would be much appreciated of you to consider adding the masking for the token added in the request body as you did for those token in the header.
(And I guess the plain-text-token in the log may also disappeared.)
Looking forward to hearing from you soon.
Yours faithfully,
Shingou
Hi pact_broker team,
I faced some problem when I tried to use the webhook to trigger the pipeline of Gitlab.
Due to the internal restriction, rather than Project access token, I was only abled to use Pipeline trigger token, which is only allowed to be added into the request body like
"token": {Pipeline-trigger-token}, not the promising request header.Fortunately(or of course), it do trigger the pipeline at the currect timing as we wished.
While the problem is that the token added into the reqeust body wasn't masked as the one in added into the request header and the token has been shown in plaintext in the webhook setting or the webhook logs of Pact Broker, which may induce security concern.
It would be much appreciated of you to consider adding the masking for the token added in the request body as you did for those token in the header.
(And I guess the plain-text-token in the log may also disappeared.)
Looking forward to hearing from you soon.
Yours faithfully,
Shingou