Skip to content

Commit dba2499

Browse files
committed
chore: added warning when using client_secret
1 parent fb9f767 commit dba2499

File tree

2 files changed

+35
-0
lines changed

2 files changed

+35
-0
lines changed

aws_lambda_powertools/event_handler/openapi/swagger_ui/oauth2.py

+8
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# ruff: noqa: E501
2+
import warnings
23
from typing import Dict, Optional, Sequence
34

45
from pydantic import BaseModel, Field, validator
@@ -56,6 +57,13 @@ def client_secret_only_on_dev(cls, v: Optional[str]) -> Optional[str]:
5657
"cannot use client_secret without POWERTOOLS_DEV mode. See "
5758
"https://docs.powertools.aws.dev/lambda/python/latest/#optimizing-for-non-production-environments",
5859
)
60+
else:
61+
warnings.warn(
62+
"OAuth2Config is using client_secret and POWERTOOLS_DEV is set. This reveals sensitive information. "
63+
"DO NOT USE THIS OUTSIDE LOCAL DEVELOPMENT",
64+
stacklevel=2,
65+
)
66+
5967
return v
6068

6169

tests/functional/event_handler/test_openapi_swagger.py

+27
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
import json
2+
import warnings
23
from typing import Dict
34

5+
import pytest
6+
47
from aws_lambda_powertools.event_handler import APIGatewayRestResolver
8+
from aws_lambda_powertools.event_handler.openapi.swagger_ui import OAuth2Config
59
from tests.functional.utils import load_event
610

711
LOAD_GW_EVENT = load_event("apiGatewayProxyEvent.json")
@@ -112,3 +116,26 @@ def test_openapi_swagger_with_rest_api_stage():
112116
result = app(event, {})
113117
assert result["statusCode"] == 200
114118
assert "ui.specActions.updateUrl('/prod/swagger?format=json')" in result["body"]
119+
120+
121+
def test_openapi_swagger_oauth2_without_powertools_dev():
122+
with pytest.raises(ValueError) as exc:
123+
OAuth2Config(app_name="OAuth2 app", client_id="client_id", client_secret="verysecret")
124+
125+
assert "cannot use client_secret without POWERTOOLS_DEV mode" in str(exc.value)
126+
127+
128+
def test_openapi_swagger_oauth2_with_powertools_dev(monkeypatch):
129+
monkeypatch.setenv("POWERTOOLS_DEV", "1")
130+
131+
with warnings.catch_warnings(record=True) as w:
132+
warnings.simplefilter("default")
133+
134+
OAuth2Config(app_name="OAuth2 app", client_id="client_id", client_secret="verysecret")
135+
136+
assert str(w[-1].message) == (
137+
"OAuth2Config is using client_secret and POWERTOOLS_DEV is set. This reveals sensitive information. "
138+
"DO NOT USE THIS OUTSIDE LOCAL DEVELOPMENT"
139+
)
140+
141+
monkeypatch.delenv("POWERTOOLS_DEV")

0 commit comments

Comments
 (0)