>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3607972. --> Reported by: [luke.leber](https://www.drupal.org/user/3509746) Related to !5 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>The presence of a newline character in the API token can cause credentials to leak into log messages.</p> <p>Guzzle HTTP has a <a href="https://github.com/guzzle/guzzle/issues/2851">very unfortunate security posture</a> when it comes to this type of flaw. They assume that all users of Guzzle should take precautions against sensitive credentials being included in log messages.</p> <p>I've also reported this same type of flaw to the Google reCAPTCHA product security channel, but that was closed as a wontfix.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <p>Set up a <code>key</code> for the API token, but forget to check the "strip newline" checkbox on the key configuration.</p> <pre>2026-07-02T13:25:10Z&nbsp; [error]&nbsp; purger_cloudflare_8e22ab6ee0: InvalidArgumentException when making Cloudflare purge request with the following data: {"tags":["263x5c","1upqbl","1zter8","3e4xp0","esz1ba","138lkl","2plcon","1s2nrd","3reoen","138lkl","kvngvs","1k925f","sars05","kq8x9o","2plcon","bc0r1r","1ltqo4","14gv6h","25plgt","1s2nrd","1zuqs3","388od0","341le0","2tpqow","1ao6c8","1upqbl","263x5c"]}. Exception message: "Bearer &lt;THE PLAIN TEXT TOKEN&gt;<br>2026-07-02T13:25:10Z " is not valid header value.</pre><p>&#128561;&#128561;&#128561;&#128561;&#128561;</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>There are a few things that can be done here:</p> <ol> <li>Trim the API token before passing it into Guzzle and <strong><em>pray</em></strong> that a newline in a header is the only way to make a credential pop out in the logs.</li> <li>Filter out the API token somehow.</li> <li>Swallow the Guzzle exception and log something opaque instead.</li> <li>Try to talk some sense into the Guzzle maintainers regarding the logic of allowing the plain-text rendition of an <code>Authorization</code> header into an exception message &#129335;&#129335;&#129335;</li> </ol> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p>Decide which resolution to go with.</p> <h3 id="summary-ui-changes">User interface changes</h3> <p>None</p> <h3 id="summary-api-changes">API changes</h3> <p>None</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>None</p>