apache/dubbo
View on GitHub[Bug] RpcException message should not contain the accessKey and secretKey from MSE Nacos
Open
#15678 opened on Sep 9, 2025
help wantedtype/bug
Description
Pre-check
- I am sure that all the content I provide is in English.
Search before asking
- I had searched in the issues and found no similar issues.
Apache Dubbo Component
Java SDK (apache/dubbo)
Dubbo Version
dubbo::3.2.x & 3.3.x nacos:2.x
case01:
dubbo.registry.address=nacos://${mseNacosAddress}:8848?accessKey=${accessKey}&secretKey=${secretKey}
case02:
dubbo.registry.address=nacos://${mseNacosAddress}:8848
dubbo.registry.parameters.accessKey=${accessKey}
dubbo.registry.parameters.secretKey=${secretKey}
Steps to reproduce this issue
- Modify
destroyed=truethrough debug (or Arthas). - RpcException message contain sensitive properties, e.g.
org.apache.dubbo.rpc.RpcException:
Directory of type ServiceDiscoveryRegistryDirectory already destroyed for service com.xxx.dubbo.DemoDubboService:1.0 from registry nacos://mes-nacos-address:8848/org.apache.dubbo.registry.RegistryService?...&accessKey=...&secretKey=...
What you expected to happen
RpcException message should not contain sensitive properties.
Anything else
If Apache Nacos uses username&password AUTH, dubbo will remove sensitive properties。
备注:如果使用 case02 的方式配置,dubbo会特殊处理将 username&password 从 url 的 parameters中移除。因此,RpcExceptiony异常信息中不会包含敏感信息。但是,dubbo并未特殊处理 MSE Nacos 的 accessKey&secretKey。
Are you willing to submit a pull request to fix on your own?
- Yes I am willing to submit a pull request on my own!
Code of Conduct
- I agree to follow this project's Code of Conduct