Skip to content

Commit 1066bc5

Browse files
ahus1ahus1
committed
Deploying to main from @ 97513b6594b0830d55f00d58f65dd0c3486e6213 🚀
1 parent a12511c commit 1066bc5

5 files changed

Lines changed: 153 additions & 5 deletions

File tree

‎extensions.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -591,7 +591,7 @@ <h5 class="card-title">Terraform provider for Keycloak</h5>
591591
<div class="d-flex align-items-center">
592592
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
593593
class="me-2"/>
594-
<span data-nosnippet>877 stars</span>
594+
<span data-nosnippet>878 stars</span>
595595
</div>
596596
</div>
597597
</div>

‎nightly/server/all-config.html‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ <h2 id="category-cache"><a class="anchor" href="#category-cache"></a>Cache</h2>
149149
</div>
150150
</div></div></td>
151151
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>ispn</code>, <code>local</code></p></td>
152-
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>ispn</code></p></td>
152+
<td class="tableblock halign-left valign-top"></td>
153153
</tr>
154154
<tr>
155155
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
@@ -2398,6 +2398,54 @@ <h2 id="category-http_access_log"><a class="anchor" href="#category-http_access_
23982398
</tr>
23992399
<tr>
24002400
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
2401+
<p><span class="options-key"><code>http-access-log-masked-cookies</code></span></p>
2402+
</div>
2403+
<div class="paragraph">
2404+
<p><span class="options-description">Set of HTTP Cookie headers whose values must be masked when the <code>long</code> pattern or <code>%{ALL_REQUEST_HEADERS}</code> format is enabled with the <code>http-access-log-pattern</code> option.</span></p>
2405+
</div>
2406+
<div id="option-extended-http_access_log-http-access-log-masked-cookies" class="openblock options-extended">
2407+
<div class="content">
2408+
<div class="paragraph">
2409+
<p><span class="options-description-extended">Selected security sensitive cookies are always masked.</span></p>
2410+
</div>
2411+
<div class="paragraph">
2412+
<p><strong>CLI:</strong> <code>--http-access-log-masked-cookies</code><br>
2413+
<strong>Env:</strong> <code>KC_HTTP_ACCESS_LOG_MASKED_COOKIES</code></p>
2414+
</div>
2415+
</div>
2416+
</div>
2417+
<div class="paragraph">
2418+
<p>Available only when HTTP Access log is enabled</p>
2419+
</div></div></td>
2420+
<td class="tableblock halign-left valign-top"><p class="tableblock"><em>List</em></p></td>
2421+
<td class="tableblock halign-left valign-top"></td>
2422+
</tr>
2423+
<tr>
2424+
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
2425+
<p><span class="options-key"><code>http-access-log-masked-headers</code></span></p>
2426+
</div>
2427+
<div class="paragraph">
2428+
<p><span class="options-description">Set of HTTP headers whose values must be masked when the <code>long</code> pattern or <code>%{ALL_REQUEST_HEADERS}</code> format is enabled with the <code>http-access-log-pattern</code> option.</span></p>
2429+
</div>
2430+
<div id="option-extended-http_access_log-http-access-log-masked-headers" class="openblock options-extended">
2431+
<div class="content">
2432+
<div class="paragraph">
2433+
<p><span class="options-description-extended">Selected security sensitive headers are always masked.</span></p>
2434+
</div>
2435+
<div class="paragraph">
2436+
<p><strong>CLI:</strong> <code>--http-access-log-masked-headers</code><br>
2437+
<strong>Env:</strong> <code>KC_HTTP_ACCESS_LOG_MASKED_HEADERS</code></p>
2438+
</div>
2439+
</div>
2440+
</div>
2441+
<div class="paragraph">
2442+
<p>Available only when HTTP Access log is enabled</p>
2443+
</div></div></td>
2444+
<td class="tableblock halign-left valign-top"><p class="tableblock"><em>List</em></p></td>
2445+
<td class="tableblock halign-left valign-top"></td>
2446+
</tr>
2447+
<tr>
2448+
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
24012449
<p><span class="options-key"><code>http-access-log-pattern</code></span></p>
24022450
</div>
24032451
<div class="paragraph">

‎nightly/server/caching.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1110,7 +1110,7 @@ <h2 id="_relevant_options"><a class="anchor" href="#_relevant_options"></a>Relev
11101110
</div>
11111111
</div></div></td>
11121112
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>ispn</code>, <code>local</code></p></td>
1113-
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>ispn</code></p></td>
1113+
<td class="tableblock halign-left valign-top"></td>
11141114
</tr>
11151115
<tr>
11161116
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">

‎nightly/server/logging.html‎

Lines changed: 101 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -656,7 +656,7 @@ <h3 id="_change_log_formatpattern"><a class="anchor" href="#_change_log_formatpa
656656
</td>
657657
<td class="content">
658658
HTTP Access logs may contain sensitive HTTP headers like <code>Authorization</code>, <code>Cookie</code>, or external API keys references.
659-
Be careful with using the <code>long</code> pattern or printing the headers by the custom format - you should use it only for development purposes.
659+
The <code>Authorization</code> header and selected sensitive cookies are automatically masked in the HTTP Access log. However, the list of masked items might not be complete. Be careful with using the <code>long</code> pattern or printing the headers by the custom format - you should use it only for development purposes. To extend the list of the masked items, see below.
660660
</td>
661661
</tr>
662662
</table>
@@ -666,6 +666,58 @@ <h3 id="_change_log_formatpattern"><a class="anchor" href="#_change_log_formatpa
666666
</div>
667667
</div>
668668
<div class="sect2">
669+
<h3 id="_mask_specific_http_headers_and_cookies"><a class="anchor" href="#_mask_specific_http_headers_and_cookies"></a>Mask specific HTTP headers and cookies</h3>
670+
<div class="paragraph">
671+
<p>Selected sensitive HTTP headers and cookies are automatically masked in the HTTP Access log.</p>
672+
</div>
673+
<div class="paragraph">
674+
<p>Masked sensitive HTTP headers:</p>
675+
</div>
676+
<div class="ulist">
677+
<ul>
678+
<li>
679+
<p><code>Authorization</code></p>
680+
</li>
681+
</ul>
682+
</div>
683+
<div class="paragraph">
684+
<p>Masked sensitive Keycloak cookies:</p>
685+
</div>
686+
<div class="ulist">
687+
<ul>
688+
<li>
689+
<p><code>AUTH_SESSION_ID</code></p>
690+
</li>
691+
<li>
692+
<p><code>KC_AUTH_SESSION_HASH</code></p>
693+
</li>
694+
<li>
695+
<p><code>KEYCLOAK_IDENTITY</code></p>
696+
</li>
697+
<li>
698+
<p><code>KEYCLOAK_SESSION</code></p>
699+
</li>
700+
<li>
701+
<p><code>AUTH_SESSION_ID_LEGACY</code></p>
702+
</li>
703+
<li>
704+
<p><code>KEYCLOAK_IDENTITY_LEGACY</code></p>
705+
</li>
706+
<li>
707+
<p><code>KEYCLOAK_SESSION_LEGACY</code></p>
708+
</li>
709+
</ul>
710+
</div>
711+
<div class="paragraph">
712+
<p>In order to extend the list of the masked items (e.g. to accommodate for headers and cookies used by your custom extensions), configure the <code>http-access-log-masked-headers</code> and <code>http-access-log-masked-cookies</code> options.</p>
713+
</div>
714+
<div class="listingblock">
715+
<div class="content">
716+
<pre class="highlight"><code class="language-bash" data-lang="bash">bin/kc.[sh|bat] start --http-access-log-enabled=true --http-access-log-masked-headers=X-Custom,Y-Api-Token --http-access-log-masked-cookies=MY_COOKIE,MY_SECOND_COOKIE</code></pre>
717+
</div>
718+
</div>
719+
</div>
720+
<div class="sect2">
669721
<h3 id="_exclude_specific_url_paths"><a class="anchor" href="#_exclude_specific_url_paths"></a>Exclude specific URL paths</h3>
670722
<div class="paragraph">
671723
<p>It is possible to exclude specific URL paths from the HTTP access logging, so they will not be recorded.</p>
@@ -1632,6 +1684,54 @@ <h3 id="_http_access_log"><a class="anchor" href="#_http_access_log"></a>HTTP Ac
16321684
</tr>
16331685
<tr>
16341686
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
1687+
<p><span class="options-key"><code>http-access-log-masked-cookies</code></span></p>
1688+
</div>
1689+
<div class="paragraph">
1690+
<p><span class="options-description">Set of HTTP Cookie headers whose values must be masked when the <code>long</code> pattern or <code>%{ALL_REQUEST_HEADERS}</code> format is enabled with the <code>http-access-log-pattern</code> option.</span></p>
1691+
</div>
1692+
<div class="openblock options-extended">
1693+
<div class="content">
1694+
<div class="paragraph">
1695+
<p><span class="options-description-extended">Selected security sensitive cookies are always masked.</span></p>
1696+
</div>
1697+
<div class="paragraph">
1698+
<p><strong>CLI:</strong> <code>--http-access-log-masked-cookies</code><br>
1699+
<strong>Env:</strong> <code>KC_HTTP_ACCESS_LOG_MASKED_COOKIES</code></p>
1700+
</div>
1701+
</div>
1702+
</div>
1703+
<div class="paragraph">
1704+
<p>Available only when HTTP Access log is enabled</p>
1705+
</div></div></td>
1706+
<td class="tableblock halign-left valign-top"><p class="tableblock"><em>List</em></p></td>
1707+
<td class="tableblock halign-left valign-top"></td>
1708+
</tr>
1709+
<tr>
1710+
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
1711+
<p><span class="options-key"><code>http-access-log-masked-headers</code></span></p>
1712+
</div>
1713+
<div class="paragraph">
1714+
<p><span class="options-description">Set of HTTP headers whose values must be masked when the <code>long</code> pattern or <code>%{ALL_REQUEST_HEADERS}</code> format is enabled with the <code>http-access-log-pattern</code> option.</span></p>
1715+
</div>
1716+
<div class="openblock options-extended">
1717+
<div class="content">
1718+
<div class="paragraph">
1719+
<p><span class="options-description-extended">Selected security sensitive headers are always masked.</span></p>
1720+
</div>
1721+
<div class="paragraph">
1722+
<p><strong>CLI:</strong> <code>--http-access-log-masked-headers</code><br>
1723+
<strong>Env:</strong> <code>KC_HTTP_ACCESS_LOG_MASKED_HEADERS</code></p>
1724+
</div>
1725+
</div>
1726+
</div>
1727+
<div class="paragraph">
1728+
<p>Available only when HTTP Access log is enabled</p>
1729+
</div></div></td>
1730+
<td class="tableblock halign-left valign-top"><p class="tableblock"><em>List</em></p></td>
1731+
<td class="tableblock halign-left valign-top"></td>
1732+
</tr>
1733+
<tr>
1734+
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
16351735
<p><span class="options-key"><code>http-access-log-pattern</code></span></p>
16361736
</div>
16371737
<div class="paragraph">

‎translations.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -700,7 +700,7 @@ <h1>Translations</h1>
700700
</tbody>
701701
</table>
702702

703-
<p data-nosnippet>(Statistics updated daily. Last update: 2026-01-19T12:14:42Z)</p>
703+
<p data-nosnippet>(Statistics updated daily. Last update: 2026-01-20T05:12:43Z)</p>
704704

705705
</div>
706706

0 commit comments

Comments
 (0)