Add explicit warnings about unsafe OAuth trace output for libpq
Hackorum builds and tests every patch posted to the lists, not only commitfest submissions. This is Hackorum's own CI rather than the PostgreSQL project's, and it is still under testing - please report anything that looks wrong.
You can run a PostgreSQL built from this patch straight from Docker, with no checkout and no build:
docker run --rm -p 5432:5432 ghcr.io/hackorum-dev/postgres-patch:t139240psql -h localhost -U postgresBuilt from patchset v3 (message #3), August 25, 2026 at 12:32 PM.
Every patchset is also pushed to a branch of our PostgreSQL fork, so you can check out the same tree CI built. Without a PostgreSQL checkout:
git clone --branch t139240_3 https://github.com/hackorum-dev/postgres.gitIn a checkout you already have, add the fork once:
git remote add hackorum https://github.com/hackorum-dev/postgres.gitthen, for this patchset and every later one:
git fetch hackorum t139240_3 && git checkout t139240_3Patchset v3 (message #3) is on t139240_3
Hello
This is based on earlier messages in the thread about OAUTHDEBUG splitting[1]/messages/by-id/CAOYmi+kfw76zPa-tZPNs4KjxwthGLkQfpGyoKzMMy8_oNJz4DQ@mail.gmail.com:
With the same logic, shouldn't we print a very visible warning when
somebody enables trace? Since it's a long output, maybe to both the
beginning and end of the flow?I'm more than happy to strengthen this as well, but let's kick that
out to its own thread, especially if pieces are backpatchable.
The documentation already mentions that this option is unsafe because
it prints out the HTTP traffic as-is, including secrets, but the
output itself lacks a warning about it.
Because the output is long, users might not notice that copy-pasting
it or saving it to disk will share sensitive information. To increase
visibility, this patch adds a warning to both the beginning and the
end of the output.
I also attached a version for 18, since this seems to be a useful
change to backport. With the recent changes this is slightly different
on 19.
[1]: /messages/by-id/CAOYmi+kfw76zPa-tZPNs4KjxwthGLkQfpGyoKzMMy8_oNJz4DQ@mail.gmail.com
Attachments:
rel18-0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.patchapplication/octet-stream; name=rel18-0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.patchDownload+9-1
0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.patchapplication/octet-stream; name=0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.patchDownload+9-1
Hello
I have re-attached the same patches with simplified commit messages,
and I also marked the PG18 version with nocfbot so the master version
can apply correctly.
Show quoted text
On Tue, Apr 7, 2026 at 7:28 PM Zsolt Parragi <zsolt.parragi@percona.com> wrote:
Hello
This is based on earlier messages in the thread about OAUTHDEBUG splitting[1]:
With the same logic, shouldn't we print a very visible warning when
somebody enables trace? Since it's a long output, maybe to both the
beginning and end of the flow?I'm more than happy to strengthen this as well, but let's kick that
out to its own thread, especially if pieces are backpatchable.The documentation already mentions that this option is unsafe because
it prints out the HTTP traffic as-is, including secrets, but the
output itself lacks a warning about it.Because the output is long, users might not notice that copy-pasting
it or saving it to disk will share sensitive information. To increase
visibility, this patch adds a warning to both the beginning and the
end of the output.I also attached a version for 18, since this seems to be a useful
change to backport. With the recent changes this is slightly different
on 19.[1]: /messages/by-id/CAOYmi+kfw76zPa-tZPNs4KjxwthGLkQfpGyoKzMMy8_oNJz4DQ@mail.gmail.com
Attachments:
t139240_2rel18-0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.nocfbot.patchapplication/octet-stream; name=rel18-0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.nocfbot.patchDownload+9-1
0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.patchapplication/octet-stream; name=0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.patchDownload+9-1
Same patches, rebased on current branches.
Show quoted text
On Sat, Jun 13, 2026 at 8:34 PM Zsolt Parragi <zsolt.parragi@percona.com> wrote:
Hello
I have re-attached the same patches with simplified commit messages,
and I also marked the PG18 version with nocfbot so the master version
can apply correctly.On Tue, Apr 7, 2026 at 7:28 PM Zsolt Parragi <zsolt.parragi@percona.com> wrote:
Hello
This is based on earlier messages in the thread about OAUTHDEBUG splitting[1]:
With the same logic, shouldn't we print a very visible warning when
somebody enables trace? Since it's a long output, maybe to both the
beginning and end of the flow?I'm more than happy to strengthen this as well, but let's kick that
out to its own thread, especially if pieces are backpatchable.The documentation already mentions that this option is unsafe because
it prints out the HTTP traffic as-is, including secrets, but the
output itself lacks a warning about it.Because the output is long, users might not notice that copy-pasting
it or saving it to disk will share sensitive information. To increase
visibility, this patch adds a warning to both the beginning and the
end of the output.I also attached a version for 18, since this seems to be a useful
change to backport. With the recent changes this is slightly different
on 19.[1]: /messages/by-id/CAOYmi+kfw76zPa-tZPNs4KjxwthGLkQfpGyoKzMMy8_oNJz4DQ@mail.gmail.com
Attachments:
t139240_30001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.patchapplication/octet-stream; name=0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-.patchDownload+10-1
rel18-0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-nocfbot.patchapplication/octet-stream; name=rel18-0001-libpq-oauth-Warn-when-PGOAUTHDEBUG-trace-may-expose-nocfbot.patchDownload+9-1
On 19 Aug 2026, at 14:06, Zsolt Parragi <zsolt.parragi@percona.com> wrote:
The documentation already mentions that this option is unsafe because
it prints out the HTTP traffic as-is, including secrets, but the
output itself lacks a warning about it.Because the output is long, users might not notice that copy-pasting
it or saving it to disk will share sensitive information. To increase
visibility, this patch adds a warning to both the beginning and the
end of the output.
I think it's a good idea to include a warning in the output like this. Ideally
it's just repeating what the user already knew but in case someone
missed/skipped the docs it's a healthy reminder. Unless there are different
opinions I proose to go ahead with this one.
--
Daniel Gustafsson