PRIVATE-TOKEN is logged as part of `json.path`

Original Issue

Summary

1. Some messages are logging the request.fullpath and hence not doing any filtering
2. PRIVATE-TOKEN is not filtered

Impact

Customer glpat- are exposed in Kibana logs

Recommendation

1. Use request.filtered_path when logging.
2. Add PRIVATE-TOKEN to filter parameter list.

The known logs are Rack_Attack and Application_Rate_Limiter_Request

• https://log.gprd.gitlab.net/app/r/s/cBdJa
• https://log.gprd.gitlab.net/app/r/s/CKRY1

Probable places in code :

• app/controllers/application_controller.rb
• lib/gitlab/middleware/path_traversal_check.rb
• lib/gitlab/middleware/go.rb
• lib/gitlab/application_rate_limiter.rb
• lib/gitlab/auth.rb
• app/controllers/concerns/invisible_captcha_on_signup.rb

Verification

Check Kibana logs for json.path: glpat

Summary

Some log messages include request.fullpath without applying filters, resulting in sensitive information being logged. Specifically, PRIVATE-TOKEN values, such as glpat- tokens, are visible in Kibana logs without filtering.

Steps to Reproduce

1. Trigger a log entry containing a glpat- token. See this comment
2. Check the logs in Kibana for unfiltered entries where the PRIVATE-TOKEN appears

What is the Current Bug Behaviour?

Logs capture and expose sensitive tokens (e.g., glpat- tokens) in plain text within Kibana logs.

What is the Expected Correct Behaviour?

Logs should filter sensitive information, ensuring PRIVATE-TOKEN values are not displayed in logs.

Relevant Logs and/or Screenshots

Example impacted logs:

• Rack_Attack
• Application_Rate_Limiter_Request

Probable Code Locations

• app/controllers/application_controller.rb
• lib/gitlab/middleware/path_traversal_check.rb
• lib/gitlab/middleware/go.rb
• lib/gitlab/application_rate_limiter.rb
• lib/gitlab/auth.rb
• app/controllers/concerns/invisible_captcha_on_signup.rb

Recommendation

1. Replace request.fullpath with request.filtered_path in logging
2. Add PRIVATE-TOKEN to the filter parameter list to prevent exposure in logs

Verification

Check the Kibana logs post-update to confirm that sensitive tokens, such as glpat, no longer appear unfiltered in log entries.