Token Leakage in Flask with Bearer Tokens

Token leakage in Flask applications using Bearer Tokens occurs when access tokens are exposed beyond the intended scope, often due to insecure handling, logging, or transmission practices. Flask does not enforce any built-in token handling; developers are responsible for securing how tokens are stored, transmitted, and logged. Because Bearer Tokens are typically sent in the Authorization header, any misconfiguration or unsafe pattern can inadvertently expose them.

One common scenario involves logging full request headers or URLs. If a Flask route logs request.headers or request.url without redacting sensitive authorization data, tokens can end up in log files, structured logging systems, or error tracking services. Another leakage vector is error responses: unhandled exceptions or debug outputs in development mode may include headers in tracebacks. Transmitting tokens over non-TLS connections is another risk; without HTTPS, Bearer Tokens can be intercepted in transit. Additionally, storing tokens in insecure client-side storage (e.g., local storage) and referencing them in Flask-rendered templates or JavaScript can expose them to cross-site scripting (XSS). Even if Flask sets tokens in secure, HttpOnly cookies, referencing them incorrectly in client-side code can lead to exposure. Finally, improper scope and lifetime management—such as using long-lived tokens without refresh rotation—increases the window during which a leaked token is useful to an attacker.

These risks are not theoretical; patterns like verbose debugging in Flask’s debug mode, misconfigured log formatters, and missing HTTPS enforcement have led to real-world token exposures. For example, frameworks like Flask that rely on manual header handling require strict discipline to prevent sensitive data from appearing in logs or error pages. Attackers actively search for leaked tokens in log repositories and error tracking systems to gain unauthorized access to backend services.

Remediation focuses on secure transmission, careful logging, and runtime protection. Always serve Flask applications over HTTPS in production to protect tokens in transit. Use short-lived Bearer Tokens and rotate them regularly. Avoid logging sensitive headers, and sanitize any output that may include authorization data.

Secure Bearer Token usage in Flask (code examples)

Example 1: Validating and using a Bearer Token from the Authorization header without logging it.

from flask import Flask, request, jsonify, abort
import re

app = Flask(__name__)

# A simple in-memory token store for demonstration; use a secure vault in production
VALID_TOKENS = {"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9": "user_123"}

@app.before_request
def require_auth():
    auth = request.headers.get("Authorization")
    if not auth or not auth.startswith("Bearer "):
        abort(401, description="Missing or invalid Authorization header")
    token = auth.split(" ", 1)[1]
    if token not in VALID_TOKENS:
        abort(401, description="Invalid token")
    # Attach user info to request context for downstream use
    request.user_id = VALID_TOKENS[token]

@app.route("/api/me")
def me():
    return jsonify({"user_id": request.user_id})

if __name__ == "__main__":
    # WARNING: debug=True is for development only; use proper WSGI in production
    app.run(ssl_context="adhoc")  # adhoc HTTPS for local testing

Example 2: Safe logging that redacts Authorization headers.

import logging
from flask import Flask, request

app = Flask(__name__)

class RedactingFilter(logging.Filter):
    def filter(self, record):
        if hasattr(record, "msg") and isinstance(record.msg, str):
            # Redact Bearer tokens in log messages
            record.msg = re.sub(r"Bearer \S+", "Bearer [REDACTED]", record.msg)
        return True

redactor = RedactingFilter()
app.logger.addFilter(redactor)

@app.route("/api/data")
def get_data():
    app.logger.info(f"Request received: {request.method} {request.path}")
    # Do not log request.headers directly
    return "ok"

Example 3: Enforce HTTPS and secure cookie practices when tokens are stored client-side.

from flask import Flask, make_response

app = Flask(__name__)

@app.route("/set-token")
def set_token():
    resp = make_response(jsonify({"status": "token set on client"}))
    # If storing token in a cookie, use Secure and HttpOnly; avoid JS access
    resp.set_cookie(
        "access_token",
        "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
        httponly=True,
        secure=True,
        samesite="Lax"
    )
    return resp

These examples illustrate how to handle Bearer Tokens safely in Flask: validate tokens server-side, redact sensitive data in logs, enforce transport security, and minimize exposure in client-side contexts. Complementary scanning with tools like middleBrick can help detect token leakage by analyzing the unauthenticated attack surface, identifying insecure logging patterns, and flagging transmission without encryption.