From 9ed4fdd48971a7dd50fbb14acfe7efd2023351e7 Mon Sep 17 00:00:00 2001
From: jgrusewski <jgrusewski@localhost>
Date: Sun, 22 Feb 2026 06:27:10 +0100
Subject: [PATCH] safety(api-gateway): remove debug token logging from JWT
 interceptor

Removed error!() call that logged the full JWT token on decode failure.
This was a security risk - tokens should never appear in logs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 services/api_gateway/src/auth/interceptor.rs | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/services/api_gateway/src/auth/interceptor.rs b/services/api_gateway/src/auth/interceptor.rs
index cd795132d..bb4489a09 100644
--- a/services/api_gateway/src/auth/interceptor.rs
+++ b/services/api_gateway/src/auth/interceptor.rs
@@ -369,11 +369,6 @@ impl JwtService {
         let token_data =
             decode::<JwtClaims>(token, &self.decoding_key, &self.validation).map_err(|e| {
                 error!("JWT decode failed in interceptor: {:?}", e);
-                error!("FULL TOKEN FOR DEBUGGING: {}", token);
-                error!(
-                    "Token (first 50 chars): {}...",
-                    &token[..50.min(token.len())]
-                );
                 let issuer_str = self
                     .validation
                     .iss