When receiving a 400 error, using the Plaid client, the error thrown will contain the PLAID-SECRET key. Since it's a common practice to log an error object, this will often result in PLAID-SECRET being leaked to logs.
Consider the following scenario:
const configuration = new Configuration({
basePath: this.config.basePath,
baseOptions: {
headers: {
'PLAID-CLIENT-ID': this.config.clientId,
'PLAID-SECRET': this.config.secret,
},
},
})
this.client = new PlaidApi(configuration)
try {
const response = await this.client.linkTokenCreate({
client_name: clientName,
country_codes: [CountryCode.Us],
language: 'en',
user: {
client_user_id: clientUserId,
},
products: this.config.products,
})
this.logger.info('Plaid link token created', {
clientName,
env: this.config.environment,
})
return response.data.link_token
} catch (err) {
this.logger.error(err)
throw err
}In this case, if we receive a 400 from the server (for example because the client_user_id is missing, or any other reason), err.config.headers will include PLAID-SECRET.
I haven't tested this with other error codes.
When receiving a 400 error, using the Plaid client, the error thrown will contain the PLAID-SECRET key. Since it's a common practice to log an error object, this will often result in PLAID-SECRET being leaked to logs.
Consider the following scenario:
In this case, if we receive a 400 from the server (for example because the
client_user_idis missing, or any other reason),err.config.headerswill includePLAID-SECRET.I haven't tested this with other error codes.