Comment 2 for bug 1655703

Revision history for this message
Donagh McCabe (donagh-mccabe) wrote :

Since this is an SAIO environment, it means that tempauth is being used. Hence, not a security issue for OpenStack (where Keystone is used).

Tempauth is only used for test purposes and is specifically not recommended for production use (see first paragraph of http://docs.openstack.org/developer/swift/overview_auth.html#tempauth). Having said this, since tempauth may be used as a basis for developing custom code, it would be worth obscuring the token in the logs. A utility function is used elsewhere in Swift to avoid the token appearing in the logs.

In summary: is not a threat to production systems, but worth fixing for it's own sake.