Dashboard: Bearer Token ID Displayed In Logs

[mhobotpplnet]

Environment

Dashboard version:v1.8.3
Kubernetes version:1.10

Steps to reproduce

Login to kubernetes dashboard with bearer token id, checkout the pod logs for k8 dashboard.

Observed result

Logs show full token ID

kubernetes-dashboard-somenumber kubernetes-dashboard 2018/07/26 12:39:10 [2018-07-26T12:39:10Z] Incoming HTTP/2.0 POST /api/v1/login request from 100.111.312.444:3587: {
kubernetes-dashboard-somenumber kubernetes-dashboard   "kubeConfig": "",
kubernetes-dashboard-somenumber kubernetes-dashboard   "password": "",
kubernetes-dashboard-somenumber kubernetes-dashboard   "token": "5122-taken-away-full-token"

Expected result

Did not expect token to be logged, and if it is , it should be detached.

Comments

If someone had access to k8 dashboard, they could take higher privileges by just parsing out the token ID and loggin with my username.
I guess one way is to disable logging but that is not suitable when trying to troubleshoot authentications etc.

[jimangel]

duplicate of https://github.com/kubernetes/dashboard/issues/3012

[jeefy]

/assign

[jeefy]

/close

Closing in favor of #3012

But, never fear. I'm diving into this today.