(polaris) branch main updated: Redact access token from PolarisCredential.toString() (#4777)

[yu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

flyrain pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git


The following commit(s) were added to refs/heads/main by this push:
     new 13a71eee0d Redact access token from PolarisCredential.toString() (#4777)
13a71eee0d is described below

commit 13a71eee0d6482535f044f65e47bf1278823497e
Author: vignesh_A <16...@users.noreply.github.com>
AuthorDate: Tue Jun 16 22:43:54 2026 +0530

    Redact access token from PolarisCredential.toString() (#4777)
---
 CHANGELOG.md                                                       | 1 +
 .../java/org/apache/polaris/service/auth/PolarisCredential.java    | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0a75937528..9d2b1046d5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -63,6 +63,7 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
 ### Fixes
 - `RateLimiterFilter` now returns an Iceberg-compatible `ErrorResponse` JSON body on HTTP 429, with `Content-Type: application/json`. Previously the body was empty, causing Iceberg REST clients to surface an opaque error.
 - The admin tool `purge` command now prints the underlying exception stack trace to stderr when a purge fails unexpectedly, matching the `bootstrap` command. Previously a failed purge printed only a generic message, giving operators no diagnostic information.
+- The access token carried in `PolarisCredential` is now redacted from its `toString()`, so it is no longer written to authentication logs (including at WARN level on failed authentication).
 
 ## [1.5.0]
 
diff --git a/runtime/service/src/main/java/org/apache/polaris/service/auth/PolarisCredential.java b/runtime/service/src/main/java/org/apache/polaris/service/auth/PolarisCredential.java
index a2d735e41b..32b7f379b3 100644
--- a/runtime/service/src/main/java/org/apache/polaris/service/auth/PolarisCredential.java
+++ b/runtime/service/src/main/java/org/apache/polaris/service/auth/PolarisCredential.java
@@ -21,6 +21,7 @@ package org.apache.polaris.service.auth;
 import io.quarkus.security.credential.Credential;
 import java.util.Set;
 import org.apache.polaris.immutables.PolarisImmutable;
+import org.immutables.value.Value;
 import org.jspecify.annotations.Nullable;
 
 /**
@@ -57,6 +58,10 @@ public interface PolarisCredential extends Credential {
   /** The principal roles, or empty if the principal has no roles. */
   Set<String> getPrincipalRoles();
 
-  /** The access token of the current user, or null if not applicable. */
+  /**
+   * The access token of the current user, or null if not applicable. Redacted from {@code
+   * toString()} so it is not leaked into logs.
+   */
+  @Value.Redacted
   @Nullable String getToken();
 }