MicrosoftDynamics.Api 10.0.45

• net10.0

  • Microsoft.Extensions.Logging.Abstractions (>= 10.0.11)
  • PanoramicData.OData.Client (>= 10.0.123)

10.0.45

The redaction marker for scheme-prefixed sensitive headers is reordered so that a redacted
header can no longer be mistaken for a leaked one by a log search.

A redacted Authorization header now renders as "Authorization=<redacted Bearer, length 1842>"
rather than "Authorization=Bearer <redacted, length 1842>". The same information is present -
header name, scheme and credential length - in a different order.

Why: log stores analyse the message with the standard analyzer, which discards '=', ':' and '<'
alike. Both the old redacted render and a genuine "Authorization: Bearer eyJ0..." leak therefore
tokenised to "authorization" followed by "bearer", which is exactly the adjacency a phrase query
tests for. A search for "Authorization: Bearer" - the obvious way to hunt for leaked tokens -
matched every redaction, so 10.0.28's fix could not be shown to be working. Downstream this cost
a failed test cycle and a Major security defect raised against correctly-redacted log entries.
With the scheme inside the marker, that search returns only genuine leaks.

Consumers who search their logs for leaked credentials can now rely on a phrase search for
"Authorization: Bearer". Anyone parsing the marker's text, or asserting on it in a test, will
need updating.

10.0.42

Internal refactor only. No public API or behaviour change; no action needed on upgrade.
The JSON parsing and access token acquisition inside MicrosoftDynamicsClient moved to
separate internal types, reducing the complexity of a single oversized file.

10.0.28

Security fix: sensitive HTTP headers are now redacted in diagnostic output.

Previously the Authorization header, and therefore a usable access token, was written verbatim
into the exception message thrown for a failed request, and into Debug level request logging.
Any consumer capturing those messages retained usable credentials for the life of its log store.

Authorization, Proxy-Authorization, Cookie, Set-Cookie and common API key headers are now
redacted in both request and response headers. The authentication scheme and the credential
length are retained, so failures remain diagnosable without exposing the credential.

Breaking change to message text: headers in the failure exception message are now rendered as
"Name=value" rather than "Name: value". Code that parses that message will need updating.

Consumers upgrading from a version earlier than 10.0.28 should review existing logs for
previously captured tokens.