Skip to content

feat: add logging for OAuth user information in OAuthUserService #338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jbh010204 merged 1 commit into from
Aug 12, 2025
Merged

feat: add logging for OAuth user information in OAuthUserService #338

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/main/java/life/mosu/mosuserver/application/oauth/OAuthUserService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ public OAuth2User loadUser(final OAuth2UserRequest userRequest)
oAuth2UserAttributes, agreedToMarketing);

final UserJpaEntity oAuthUser = oAuthUserPersistenceProcessor.process(userInfo);

log.info("OAuthUser: {}", oAuthUser);
Copy link

@gemini-code-assist gemini-code-assist bot Aug 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

로깅하는 oAuthUser 객체는 toString() 메서드를 통해 사용자의 민감한 개인정보(이메일, 이름, 생년월일, 전화번호 등)를 포함하고 있습니다. 이 정보를 로그에 남기는 것은 심각한 보안 취약점이 될 수 있습니다. 개인정보보호 규정(예: GDPR, 개인정보보호법)을 위반할 소지가 있으며, 로그 파일이 유출될 경우 사용자 정보가 노출될 위험이 있습니다.

사용자 객체 전체를 로깅하는 대신, 처리를 확인하는 데 필요한 최소한의 정보(예: 사용자 ID)만 로깅하는 것을 강력히 권장합니다.

Suggested change
log.info("OAuthUser: {}", oAuthUser);
log.info("OAuth user processed for ID: {}", oAuthUser.getId());

Boolean isProfileRegistered = profileRepository.existsByUserId(oAuthUser.getId());

return new OAuthUser(oAuthUser, oAuth2UserAttributes, userNameAttributeName,
Expand Down