Comment 0 for bug 1655703

When using a token to do an AUTH_test, the swift proxy logs the token used if successful, this can lead to possible security issue by granting access to a swift cluster to a person who just has access to the logs. This issue is present when tempAuth authentication flow is used.

The steps to recreate the issue:

1. Install a swift all in one Instance (SAIO).
2. Retrieve admin token from cli using the command inside of an SAIO cluster,

```
swift -A http://saio:8080/auth/v1.0 -U admin:admin -K admin stat -v``
```

3. Retrieve the auth token from CLI and issue the command,

```
curl -i http://saio:8080/v1/AUTH_test -I -H "X-Auth-Token: AUTH_tk44d4f00971ed412396b602e46aeef57c"
```

The log written to disk when this command is executed has the token AUTH_tk44d4f00971ed412396b602e46aeef57c written to it as well.

```
Jan 10 21:31:58 ubuntu-xenial proxy-server: STDERR: (28655) accepted ('127.0.0.1', 48506)
Jan 10 21:31:58 ubuntu-xenial proxy-server: User: admin uses token AUTH_tk44d4f00971ed412396b602e46aeef57c (trans_id tx77daa27b44374e688cb82-00587552ce)
Jan 10 21:31:58 ubuntu-xenial proxy-server: User admin:admin has reseller admin authorizing. (txn: tx77daa27b44374e688cb82-00587552ce) (client_ip: 127.0.0.1)
Jan 10 21:31:58 ubuntu-xenial account-6012: STDERR: (28635) accepted ('127.0.0.1', 46292)
Jan 10 21:31:58 ubuntu-xenial account-6012: 127.0.0.1 - - [10/Jan/2017:21:31:58 +0000] "HEAD /sdb1/802/AUTH_test" 204 - "HEAD http://saio:8080/v1/AUTH_test" "tx77daa27b44374e688cb82-00587552ce" "proxy-server 28655" 0.0011 "-" 28635 -
Jan 10 21:31:58 ubuntu-xenial account-6012: STDERR: 127.0.0.1 - - [10/Jan/2017 21:31:58] "HEAD /sdb1/802/AUTH_test HTTP/1.1" 204 442 0.002273 (txn: tx77daa27b44374e688cb82-00587552ce)
Jan 10 21:31:58 ubuntu-xenial proxy-server: removed response headers: [('X-Backend-Recheck-Account-Existence', '60')] (txn: tx77daa27b44374e688cb82-00587552ce) (client_ip: 127.0.0.1)
Jan 10 21:31:58 ubuntu-xenial proxy-server: 127.0.0.1 127.0.0.1 10/Jan/2017/21/31/58 HEAD /v1/AUTH_test HTTP/1.0 204 - curl/7.47.0 AUTH_tk44d4f0097... - - - tx77daa27b44374e688cb82-00587552ce - 0.0267 - - 1484083918.178980112 1484083918.205643892 -
Jan 10
```

This is part of the swift security testing done as part of OSIC. Kindly comment if this is considered as a security issue in swift. From our perspective, under no circumstance the Auth Token be written to log files as then it can be accessed by a possible third party.