Credential disclosure through OAuth callback error logging

Impact

OAuth2 Proxy can write credentials to standard logs when an OAuth callback
contains a missing, expired, or invalid CSRF cookie. The affected diagnostics
format the complete HTTP request instead of logging only the authentication
failure.

The logged request can include session cookies, other cookies sent to the
callback endpoint, and Authorization headers containing Basic or Bearer
credentials. Anyone able to read the resulting logs, including through a
centralized logging service may obtain and replay credentials that remain
valid.

Affected deployments have standard logging enabled, which is the default, and
receive a failing callback carrying credential. The credentials must actually
be present in that request to be disclosed. This is not an anonymous remote
cookie-read vulnerability: exploitation requires access to the resulting logging
infrastructure. The callback itself remains rejected by the existing CSRF checks.

Patches

v7.15.5

The fix replaces the five request-dumping diagnostics with authentication log
events containing failure reasons and cookie names, without logging cookie
values, Authorization headers, or complete requests. It also removes the
explicit state value from the affected failure message.

These diagnostics now follow --auth-logging and --auth-logging-format, rather
than the standard logging settings. Operators relying on the previous log
format should update their parsers and alerts. Callback rejection, CSRF
validation, cookie…