Outpost leaks sensitive token information by default

[thatguyatgithub]

Describe the bug

Using Outpost with traditional "Proxy" mode in Authentik (meaning, not the Forward Auth mode) has a critical undesired side effect that is logging all GET parameters including the token, user details and such.

This seems to be happening at the latest version 2026.5.3 as well.

Sample of redacted logs

{"auth_via": "session"
 "domain_url": "authentik.public-outpost-domain.com"
 "event": "/if/flow/default-provider-authorization-explicit-consent/?client_id=ABC&redirect_uri=https%3A%2F%2Fauthentik.public-outpost-domain.com%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=openid+profile+entitlements+email+ak-proxy-headers+ak_proxy+offline_access&state=ey[REDATED]"
 "host": "authentik.public-outpost-domain.com"
 "level": "info"
 "logger": "authentik.asgi"
 "method": "GET"
 "pid": 798692
 "remote": "1.2.3.4"
 "request_id": "0ab82c08d3254f82b92c447c5a83094f"
 "runtime": 51
 "schema_name": "public"
 "scheme": "https"
 "status": 200
 "timestamp": "2026-07-21T20:42:25.693034"
 "user": "user@domain.com"
 "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0"}

Please do observe that I have configured the OUTPOST with log_level: warning and it still shows up altogether.

How to reproduce

1. Enable OUTPOST provider
2. Select "PROXY" mode (and not any "Forward auth"
3. Look for authentik-server logs

Expected behavior

Have state and sensitive information redacted

Screenshots

No response

Additional context

No response

Deployment Method

Kubernetes

Version

2026.5.3

Relevant log output

[dewi-tik]

Which of these do you think is sensitive?

The state isn't sensitive because it's only valid for that one oauth authentication. So logging this isn't really an issue as it can't be used for anything untoward.