Definition
Assembly: Microsoft.OData.Mcp.Authentication.dll Namespace: Microsoft.OData.Mcp.Authentication.Outbound Inheritance: System.ObjectSyntax
Summary
Masks token and credential values out of text before it reaches a log sink, perspecs/v3/AUTHENTICATION.md “Observability -> Redaction” and “Security & Privacy -> Logging
tokens”.
Remarks
Every regular expression is source-generated (GeneratedRegexAttribute), so redaction costs no reflection, matching this library’s AOT-first posture. String) never throws on text that carries no sensitive content, because log text is redacted on every write and must never itself become a source of failure.Methods
DescribeToken
Describes a token container for logging without ever emittingAccessToken or RefreshToken.
Syntax
Parameters
Returns
Type:string
type={TokenType} expiresIn={ExpiresIn} hasRefresh={true|false} scope={Scope}, reporting
expiresIn and scope as none when absent.
Exceptions
Examples
Redact
Masks sensitive token and credential values in free-form log text.Syntax
Parameters
Returns
Type:string
text with every sensitive JSON property value, Authorization header value,
and sensitive form-encoded value replaced by ***. Text with no sensitive content, including an
empty string, is returned unchanged.
Exceptions
Examples
Remarks
Three independent passes run in order, so a single line of text can match more than one: JSON string properties namedaccess_token, refresh_token, client_secret, device_code,
code_verifier, or id_token (case-insensitive, quoted, arbitrary whitespace around
:); an Authorization header written as Authorization: <scheme> <value>
or Authorization=<scheme> <value> (header name case-insensitive); and
form-encoded name=value pairs for the same six names.