PYTHON-5928 Redact AWS session token from client repr by NguyenCong2k · Pull Request #2803 · mongodb/mongo-python-driver

NguyenCong2k · 2026-05-14T04:36:47Z

AWS session tokens passed via authMechanismProperties (for example, AWS_SESSION_TOKEN) were rendered in plain text inside MongoClient.__repr__, leaking short-lived AWS credentials into logs and error messages. The existing username/password redaction did not cover authentication mechanism properties.

Changes in this PR

Add the shared helper pymongo.common.redact_auth_mechanism_properties_for_repr, which redacts every authentication mechanism property whose upper-cased name is not in the safe allowlist (ALLOWED_HOSTS, CANONICALIZE_HOST_NAME, ENVIRONMENT, SERVICE_HOST, SERVICE_NAME, SERVICE_REALM, TOKEN_RESOURCE).
Apply the helper to the repr path in both pymongo/asynchronous/mongo_client.py and pymongo/synchronous/mongo_client.py.
Add sync and async regression coverage for:
- AWS_SESSION_TOKEN supplied through the connection URI.
- Lower-case aws_session_token and a custom CUSTOM_API_KEY supplied through authMechanismProperties kwargs.
- Safe TOKEN_RESOURCE values remaining visible.

The allowlist approach, rather than a single-key denylist, also prevents other custom token-, password-, secret-, or key-bearing properties from leaking through the client repr.

Test Plan

python -m pytest test/test_client.py::ClientUnitTest::test_repr_redacts_aws_session_token test/test_client.py::ClientUnitTest::test_repr_redacts_secret_auth_mechanism_properties test/asynchronous/test_client.py::AsyncClientUnitTest::test_repr_redacts_aws_session_token test/asynchronous/test_client.py::AsyncClientUnitTest::test_repr_redacts_secret_auth_mechanism_properties -q

Local result: 4 passed.

Manual verification:

from pymongo import MongoClient

client = MongoClient(
    "mongodb://AKIA:SECRET@localhost:27017/"
    "?authMechanism=MONGODB-AWS"
    "&authMechanismProperties=AWS_SESSION_TOKEN:SECRET-TOKEN",
    connect=False,
)
print(repr(client))  # 'AWS_SESSION_TOKEN': '<redacted>'

Checklist

Checklist for Author

Did you update the changelog (if necessary)?
Is there test coverage?
Is any followup work tracked in a JIRA ticket? PYTHON-5928

Checklist for Reviewer

Does the title of the PR reference a JIRA Ticket?
Do you fully understand the implementation?
Is all relevant documentation (README or docstring) updated?

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR addresses two security/privacy concerns: redacting the AWS session token in MongoClient __repr__ output, and ensuring the OIDC ALLOWED_HOSTS check is performed before reusing a cached authenticator.

Changes:

Redact AWS_SESSION_TOKEN in authMechanismProperties when generating client __repr__.
Move the OIDC ALLOWED_HOSTS validation in _get_authenticator to run before returning a cached authenticator.
Add corresponding tests in both sync and async test suites.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pymongo/synchronous/mongo_client.py	Adds redaction helper for AWS session token in `_repr_helper`.
pymongo/asynchronous/mongo_client.py	Mirrors the sync redaction logic for async client.
pymongo/synchronous/auth_oidc.py	Reorders allowed-hosts check to occur before cache reuse.
pymongo/asynchronous/auth_oidc.py	Mirrors the sync OIDC change for the async path.
test/test_client.py	Adds test for AWS session token redaction in repr.
test/asynchronous/test_client.py	Async counterpart for repr redaction test.
test/test_auth_oidc.py	Tests allowed-hosts check happens before cache reuse.
test/asynchronous/test_auth_oidc.py	Async counterpart for allowed-hosts cache test.

+                for key in redacted:
+                    if key.upper() == "AWS_SESSION_TOKEN":


+        def redact_auth_mechanism_properties(value: Any) -> Any:
+            if isinstance(value, dict):
+                redacted = value.copy()
+                for key in redacted:
+                    if key.upper() == "AWS_SESSION_TOKEN":
+                        redacted[key] = "<redacted>"
+                return redacted
+            return value


+    if credentials.cache.data:
+        return credentials.cache.data


+        authenticator = _get_authenticator(credentials, ("good.example.com", 27017))
+        self.assertIs(authenticator, credentials.cache.data)


+            "mongodb://AKIA:SECRET@localhost:27017/"
+            f"?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:{token}",


codeowners-service-app · 2026-07-09T13:58:24Z

Assigned aclark4life for team dbx-python because caseyclements is out of office.

Jibola · 2026-07-09T14:33:32Z

Hi, thanks for your contribution. Please update your pull request to be in line with out pull request template guidelines.

NguyenCong2k · 2026-07-10T10:30:39Z

Hi @Jibola, I've updated the PR description per the template. Ready for another look when you have a chance.

aclark4life · 2026-07-14T14:58:56Z

@NguyenCong2k Thanks! I don't see this in the PR?

Move the OIDC ALLOWED_HOSTS check in _get_authenticator ahead of the cached-authenticator early return, so a disallowed host is rejected even when a cached authenticator exists.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

+def redact_auth_mechanism_properties_for_repr(value: Any) -> Any:
+    """Redact sensitive auth mechanism properties before including them in repr."""
+    if not isinstance(value, dict):
+        return value
+
+    redacted = value.copy()
+    for key in redacted:
+        if str(key).upper() not in _SAFE_AUTH_MECHANISM_PROPS_FOR_REPR:
+            redacted[key] = "<redacted>"
+    return redacted


NguyenCong2k · 2026-07-15T02:15:02Z

@aclark4life Thanks for catching this. That OIDC item was accidentally left in this PR description; the fix was implemented and merged separately in #2801 under PYTHON-5921. I've rebased this branch onto main, removed the duplicate OIDC commit, and updated #2803 to stay scoped to PYTHON-5928 (MongoClient.__repr__ redaction only).

Copilot AI review requested due to automatic review settings May 14, 2026 04:36

NguyenCong2k requested a review from a team as a code owner May 14, 2026 04:36

NguyenCong2k requested a review from caseyclements May 14, 2026 04:36

Copilot AI reviewed May 14, 2026

View reviewed changes

NguyenCong2k force-pushed the fix-redact-aws-session-token-repr branch 2 times, most recently from fd2ade2 to 24f74fd Compare May 14, 2026 17:06

Jibola changed the title ~~Redact AWS session token from client repr~~ PYTHON-XXXX Redact AWS session token from client repr Jul 9, 2026

codeowners-service-app Bot requested a review from aclark4life July 9, 2026 13:58

Jibola marked this pull request as draft July 9, 2026 14:05

Jibola marked this pull request as ready for review July 9, 2026 14:05

Jibola changed the title ~~PYTHON-XXXX Redact AWS session token from client repr~~ PYTHON-5928 Redact AWS session token from client repr Jul 9, 2026

aclark4life requested a review from Copilot July 14, 2026 14:55

Copilot started reviewing on behalf of aclark4life July 14, 2026 14:56 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Redact AWS session token from client repr

ef49b60

NguyenCong2k force-pushed the fix-redact-aws-session-token-repr branch from 58c7007 to ef49b60 Compare July 15, 2026 02:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

PYTHON-5928 Redact AWS session token from client repr#2803

PYTHON-5928 Redact AWS session token from client repr#2803
NguyenCong2k wants to merge 1 commit into
mongodb:mainfrom
NguyenCong2k:fix-redact-aws-session-token-repr

NguyenCong2k commented May 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

codeowners-service-app Bot commented Jul 9, 2026

Uh oh!

Jibola commented Jul 9, 2026

Uh oh!

NguyenCong2k commented Jul 10, 2026

Uh oh!

aclark4life commented Jul 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

NguyenCong2k commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		authenticator = _get_authenticator(credentials, ("good.example.com", 27017))
		self.assertIs(authenticator, credentials.cache.data)

		"mongodb://AKIA:SECRET@localhost:27017/"
		f"?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:{token}",

Uh oh!

Conversation

NguyenCong2k commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes in this PR

Test Plan

Checklist

Checklist for Author

Checklist for Reviewer

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

codeowners-service-app Bot commented Jul 9, 2026

Uh oh!

Jibola commented Jul 9, 2026

Uh oh!

NguyenCong2k commented Jul 10, 2026

Uh oh!

aclark4life commented Jul 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

NguyenCong2k commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

NguyenCong2k commented May 14, 2026 •

edited

Loading