[KUDU-1896] enable redaction of data in web UI/tracing

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.3.0
• Fix Version/s: 1.3.0
• Component/s: security
• Target Version/s: 1.3.0
• Assignee: Todd Lipcon
• Reporter: Todd Lipcon
• Created: 23/Feb/17 22:31
• Updated: 03/Mar/17 05:52
• Resolved: 03/Mar/17 05:52

Description

Currently even if security is enabled, you can use the web UI tracing/rpcz/etc to see current RPC traffic, including tokens returned from ConnectToMaster RPCs, etc. We need to enable redaction for the stringified PBs in the traces, and probably offer the ability to disable web UI pages entirely.