From fdb1c14e2e69e861940a1e64eb659676dbf4402c Mon Sep 17 00:00:00 2001
From: Dogface2k <100990646+Dogface2k@users.noreply.github.com>
Date: Sun, 2 Aug 2026 14:05:13 +0100
Subject: [PATCH 1/3] UI: submit object storage creation using POST

---
 .../storage/AddObjectStoragePoolCmd.java      |  2 +-
 .../storage/AddObjectStoragePoolCmdTest.java  | 11 +++
 .../main/java/com/cloud/api/ApiServlet.java   |  7 +-
 .../java/com/cloud/api/ApiServletTest.java    | 24 +++++++
 ui/src/views/infra/AddObjectStorage.vue       |  4 +-
 .../unit/views/infra/AddObjectStorage.spec.js | 71 +++++++++++++++++++
 6 files changed, 115 insertions(+), 4 deletions(-)
 create mode 100644 ui/tests/unit/views/infra/AddObjectStorage.spec.js

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/storage/AddObjectStoragePoolCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/storage/AddObjectStoragePoolCmd.java
index 460b8d642e90..c24d61b7200b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/storage/AddObjectStoragePoolCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/storage/AddObjectStoragePoolCmd.java
@@ -32,7 +32,7 @@
 import java.util.Map;
 
 @APICommand(name = "addObjectStoragePool", description = "Adds a object storage pool", responseObject = ObjectStoreResponse.class, since = "4.19.0",
-        requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+        requestHasSensitiveInfo = true, responseHasSensitiveInfo = false)
 public class AddObjectStoragePoolCmd extends BaseCmd {
 
     /////////////////////////////////////////////////////
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/admin/storage/AddObjectStoragePoolCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/admin/storage/AddObjectStoragePoolCmdTest.java
index c7aeb8ba99bf..1669bcb60e6a 100644
--- a/api/src/test/java/org/apache/cloudstack/api/command/admin/storage/AddObjectStoragePoolCmdTest.java
+++ b/api/src/test/java/org/apache/cloudstack/api/command/admin/storage/AddObjectStoragePoolCmdTest.java
@@ -20,6 +20,7 @@
 
 import com.cloud.exception.DiscoveryException;
 import com.cloud.storage.StorageService;
+import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ResponseGenerator;
 import org.apache.cloudstack.api.response.ObjectStoreResponse;
 import org.apache.cloudstack.context.CallContext;
@@ -38,6 +39,8 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 
 @RunWith(MockitoJUnitRunner.class)
@@ -98,4 +101,12 @@ public void testAddObjectStore() throws DiscoveryException {
         Mockito.verify(storageService, Mockito.times(1))
                 .discoverObjectStore(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
     }
+
+    @Test
+    public void testRequestIsMarkedAsContainingSensitiveInformation() {
+        APICommand apiCommand = AddObjectStoragePoolCmd.class.getAnnotation(APICommand.class);
+
+        assertNotNull(apiCommand);
+        assertTrue(apiCommand.requestHasSensitiveInfo());
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/ApiServlet.java b/server/src/main/java/com/cloud/api/ApiServlet.java
index 3ac5bbb01a75..7d129664cc96 100644
--- a/server/src/main/java/com/cloud/api/ApiServlet.java
+++ b/server/src/main/java/com/cloud/api/ApiServlet.java
@@ -100,6 +100,7 @@ public class ApiServlet extends HttpServlet {
             "updaterolepermission",
             "updateprojectrolepermission",
             "createstoragepool",
+            "addobjectstoragepool",
             "addhost",
             "updatehostpassword",
             "addcluster",
@@ -241,7 +242,7 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
         if (LOGGER.isDebugEnabled()) {
             reqStr = auditTrailSb.toString() + " " + cleanQueryString;
             if (req.getMethod().equalsIgnoreCase("POST") && org.apache.commons.lang3.StringUtils.isNotBlank(command)) {
-                if (!POST_REQUESTS_TO_DISABLE_LOGGING.contains(command.toLowerCase()) && !reqParams.containsKey(ApiConstants.USER_DATA)) {
+                if (shouldLogPostRequestParameters(command, reqParams)) {
                     String cleanParamsString = getCleanParamsString(reqParams);
                     if (org.apache.commons.lang3.StringUtils.isNotBlank(cleanParamsString)) {
                         reqStr += "\n" + cleanParamsString;
@@ -771,4 +772,8 @@ private String getCleanParamsString(Map<String, String[]> reqParams) {
 
         return cleanParamsString.toString();
     }
+
+    protected boolean shouldLogPostRequestParameters(String command, Map<String, String[]> reqParams) {
+        return !POST_REQUESTS_TO_DISABLE_LOGGING.contains(command.toLowerCase()) && !reqParams.containsKey(ApiConstants.USER_DATA);
+    }
 }
diff --git a/server/src/test/java/com/cloud/api/ApiServletTest.java b/server/src/test/java/com/cloud/api/ApiServletTest.java
index 79fe4b86f859..84ebfc73283d 100644
--- a/server/src/test/java/com/cloud/api/ApiServletTest.java
+++ b/server/src/test/java/com/cloud/api/ApiServletTest.java
@@ -461,4 +461,28 @@ public void testVerify2FAWhenExpectedCommandIsNotCalled() throws UnknownHostExce
 
         Assert.assertEquals(false, result);
     }
+
+    @Test
+    public void shouldNotLogPostRequestParametersForAddObjectStoragePool() {
+        boolean result = servlet.shouldLogPostRequestParameters("addObjectStoragePool", new HashMap<>());
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void shouldLogPostRequestParametersForCommandWithoutSensitiveParameters() {
+        boolean result = servlet.shouldLogPostRequestParameters("listZones", new HashMap<>());
+
+        Assert.assertTrue(result);
+    }
+
+    @Test
+    public void shouldNotLogPostRequestParametersContainingUserData() {
+        Map<String, String[]> params = new HashMap<>();
+        params.put(ApiConstants.USER_DATA, new String[] {"sensitive-user-data"});
+
+        boolean result = servlet.shouldLogPostRequestParameters("deployVirtualMachine", params);
+
+        Assert.assertFalse(result);
+    }
 }
diff --git a/ui/src/views/infra/AddObjectStorage.vue b/ui/src/views/infra/AddObjectStorage.vue
index 5410a9b9502f..a6f1d425e355 100644
--- a/ui/src/views/infra/AddObjectStorage.vue
+++ b/ui/src/views/infra/AddObjectStorage.vue
@@ -106,7 +106,7 @@
 </template>
 <script>
 import { ref, reactive, toRaw } from 'vue'
-import { getAPI } from '@/api'
+import { postAPI } from '@/api'
 import { mixinForm } from '@/utils/mixin'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
@@ -209,7 +209,7 @@ export default {
     },
     addObjectStore (params) {
       return new Promise((resolve, reject) => {
-        getAPI('addObjectStoragePool', params).then(json => {
+        postAPI('addObjectStoragePool', params).then(json => {
           resolve()
         }).catch(error => {
           reject(error)
diff --git a/ui/tests/unit/views/infra/AddObjectStorage.spec.js b/ui/tests/unit/views/infra/AddObjectStorage.spec.js
new file mode 100644
index 000000000000..6ee541761102
--- /dev/null
+++ b/ui/tests/unit/views/infra/AddObjectStorage.spec.js
@@ -0,0 +1,71 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import mockAxios from '../../../mock/mockAxios'
+import AddObjectStorage from '@/views/infra/AddObjectStorage'
+
+jest.mock('axios', () => mockAxios)
+jest.mock('@/vue-app', () => ({
+  vueProps: {
+    $localStorage: {
+      get: jest.fn(() => null)
+    }
+  }
+}))
+
+describe('Views > infra > AddObjectStorage.vue', () => {
+  beforeEach(() => {
+    mockAxios.mockReset()
+  })
+
+  it('submits addObjectStoragePool using POST with the request in the body', async () => {
+    mockAxios.mockResolvedValue({})
+
+    const params = {
+      name: 'test-store',
+      provider: 'MinIO',
+      url: 'https://object-storage.example.test',
+      'details[0].key': 'accesskey',
+      'details[0].value': 'test-access-key',
+      'details[1].key': 'secretkey',
+      'details[1].value': 'test-secret-key'
+    }
+
+    await AddObjectStorage.methods.addObjectStore(params)
+
+    expect(mockAxios).toHaveBeenCalledTimes(1)
+    const request = mockAxios.mock.calls[0][0]
+    expect(request).toMatchObject({
+      url: '/',
+      method: 'POST'
+    })
+    expect(request.params).toBeUndefined()
+    expect(request.data).toBeInstanceOf(URLSearchParams)
+    expect(request.data.get('command')).toBe('addObjectStoragePool')
+    expect(request.data.get('response')).toBe('json')
+    expect(request.data.get('url')).toBe(params.url)
+    expect(request.data.get('details[0].value')).toBe(params['details[0].value'])
+    expect(request.data.get('details[1].value')).toBe(params['details[1].value'])
+  })
+
+  it('propagates an addObjectStoragePool API failure', async () => {
+    const error = new Error('request failed')
+    mockAxios.mockRejectedValue(error)
+
+    await expect(AddObjectStorage.methods.addObjectStore({})).rejects.toBe(error)
+  })
+})

From d4712cd85b25dde2a933ea692977f9dbed943ade Mon Sep 17 00:00:00 2001
From: Dogface2k <100990646+Dogface2k@users.noreply.github.com>
Date: Sun, 2 Aug 2026 16:57:05 +0100
Subject: [PATCH 2/3] UI: prevent credential exposure in object storage errors

---
 .../main/java/com/cloud/api/ApiServlet.java   |  27 +++--
 .../java/com/cloud/api/ApiServletTest.java    |  69 ++++++++++-
 ui/src/utils/apiError.js                      |  56 +++++++++
 ui/src/utils/plugins.js                       |   3 +-
 ui/src/utils/request.js                       |   3 +-
 ui/src/views/infra/AddObjectStorage.vue       |   2 +-
 ui/tests/unit/utils/apiError.spec.js          | 112 ++++++++++++++++++
 .../unit/views/infra/AddObjectStorage.spec.js |  28 +++++
 8 files changed, 281 insertions(+), 19 deletions(-)
 create mode 100644 ui/src/utils/apiError.js
 create mode 100644 ui/tests/unit/utils/apiError.spec.js

diff --git a/server/src/main/java/com/cloud/api/ApiServlet.java b/server/src/main/java/com/cloud/api/ApiServlet.java
index 7d129664cc96..abd328cf3d6f 100644
--- a/server/src/main/java/com/cloud/api/ApiServlet.java
+++ b/server/src/main/java/com/cloud/api/ApiServlet.java
@@ -88,7 +88,7 @@ public class ApiServlet extends HttpServlet {
     private static final Pattern GET_REQUEST_COMMANDS = Pattern.compile("^(get|list|query|find)(\\w+)+$");
     private static final HashSet<String> GET_REQUEST_COMMANDS_LIST = new HashSet<>(Set.of("isaccountallowedtocreateofferingswithtags",
             "readyforshutdown", "cloudianisenabled", "quotabalance", "quotasummary", "quotatarifflist", "quotaisenabled", "quotastatement", "verifyoauthcodeandgetuser"));
-    private static final HashSet<String> POST_REQUESTS_TO_DISABLE_LOGGING = new HashSet<>(Set.of(
+    private static final HashSet<String> REQUESTS_TO_DISABLE_PARAMETER_LOGGING = new HashSet<>(Set.of(
             "login",
             "oauthlogin",
             "createaccount",
@@ -197,11 +197,11 @@ public void run() {
         });
     }
 
-    private void checkSingleQueryParameterValue(Map<String, String[]> params) {
+    protected void checkSingleQueryParameterValue(Map<String, String[]> params) {
         params.forEach((k, v) -> {
             if (v.length > 1) {
-                String message = String.format("Query parameter '%s' has multiple values %s. Only the last value will be respected." +
-                    "It is advised to pass only a single parameter", k, Arrays.toString(v));
+                String message = String.format("Query parameter '%s' has %d values. Only the last value will be respected. " +
+                    "It is advised to pass only a single parameter", saveLogString(k), v.length);
                 LOGGER.warn(message);
             }
         });
@@ -238,17 +238,15 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
 
         // logging the request start and end in management log for easy debugging
         String reqStr = "";
-        String cleanQueryString = StringUtils.cleanString(req.getQueryString());
+        String cleanQueryString = getCleanQueryString(command, req.getQueryString(), reqParams);
         if (LOGGER.isDebugEnabled()) {
             reqStr = auditTrailSb.toString() + " " + cleanQueryString;
             if (req.getMethod().equalsIgnoreCase("POST") && org.apache.commons.lang3.StringUtils.isNotBlank(command)) {
-                if (shouldLogPostRequestParameters(command, reqParams)) {
+                if (shouldLogRequestParameters(command, reqParams)) {
                     String cleanParamsString = getCleanParamsString(reqParams);
                     if (org.apache.commons.lang3.StringUtils.isNotBlank(cleanParamsString)) {
                         reqStr += "\n" + cleanParamsString;
                     }
-                } else {
-                    reqStr += " " + command;
                 }
             }
             LOGGER.debug("===START=== " + reqStr);
@@ -773,7 +771,16 @@ private String getCleanParamsString(Map<String, String[]> reqParams) {
         return cleanParamsString.toString();
     }
 
-    protected boolean shouldLogPostRequestParameters(String command, Map<String, String[]> reqParams) {
-        return !POST_REQUESTS_TO_DISABLE_LOGGING.contains(command.toLowerCase()) && !reqParams.containsKey(ApiConstants.USER_DATA);
+    protected boolean shouldLogRequestParameters(String command, Map<String, String[]> reqParams) {
+        return (org.apache.commons.lang3.StringUtils.isBlank(command)
+                || !REQUESTS_TO_DISABLE_PARAMETER_LOGGING.contains(command.toLowerCase(java.util.Locale.ROOT)))
+                && !reqParams.containsKey(ApiConstants.USER_DATA);
+    }
+
+    protected String getCleanQueryString(String command, String queryString, Map<String, String[]> reqParams) {
+        if (!shouldLogRequestParameters(command, reqParams)) {
+            return org.apache.commons.lang3.StringUtils.isBlank(command) ? "" : "command=" + saveLogString(command);
+        }
+        return StringUtils.cleanString(queryString);
     }
 }
diff --git a/server/src/test/java/com/cloud/api/ApiServletTest.java b/server/src/test/java/com/cloud/api/ApiServletTest.java
index 84ebfc73283d..1a18c00225ae 100644
--- a/server/src/test/java/com/cloud/api/ApiServletTest.java
+++ b/server/src/test/java/com/cloud/api/ApiServletTest.java
@@ -34,11 +34,13 @@
 import org.apache.cloudstack.api.command.admin.config.ListCfgsByCmd;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
+import org.apache.logging.log4j.Logger;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
@@ -463,26 +465,81 @@ public void testVerify2FAWhenExpectedCommandIsNotCalled() throws UnknownHostExce
     }
 
     @Test
-    public void shouldNotLogPostRequestParametersForAddObjectStoragePool() {
-        boolean result = servlet.shouldLogPostRequestParameters("addObjectStoragePool", new HashMap<>());
+    public void shouldNotLogRequestParametersForAddObjectStoragePool() {
+        boolean result = servlet.shouldLogRequestParameters("addObjectStoragePool", new HashMap<>());
 
         Assert.assertFalse(result);
     }
 
     @Test
-    public void shouldLogPostRequestParametersForCommandWithoutSensitiveParameters() {
-        boolean result = servlet.shouldLogPostRequestParameters("listZones", new HashMap<>());
+    public void shouldLogRequestParametersForCommandWithoutSensitiveParameters() {
+        boolean result = servlet.shouldLogRequestParameters("listZones", new HashMap<>());
 
         Assert.assertTrue(result);
     }
 
     @Test
-    public void shouldNotLogPostRequestParametersContainingUserData() {
+    public void shouldNotLogRequestParametersContainingUserData() {
         Map<String, String[]> params = new HashMap<>();
         params.put(ApiConstants.USER_DATA, new String[] {"sensitive-user-data"});
 
-        boolean result = servlet.shouldLogPostRequestParameters("deployVirtualMachine", params);
+        boolean result = servlet.shouldLogRequestParameters("deployVirtualMachine", params);
 
         Assert.assertFalse(result);
     }
+
+    @Test
+    public void shouldReplaceQueryStringContainingUserDataWithCommandName() {
+        Map<String, String[]> params = new HashMap<>();
+        params.put(ApiConstants.USER_DATA, new String[] {"SYNTHETIC_USER_DATA"});
+        String queryString = "command=deployVirtualMachine&userdata=SYNTHETIC_USER_DATA";
+
+        String result = servlet.getCleanQueryString("deployVirtualMachine", queryString, params);
+
+        Assert.assertEquals("command=deployVirtualMachine", result);
+        Assert.assertFalse(result.contains("SYNTHETIC_USER_DATA"));
+    }
+
+    @Test
+    public void shouldReplaceSensitiveQueryStringWithCommandName() {
+        Map<String, String[]> params = new HashMap<>();
+        String queryString = "command=addObjectStoragePool&details%5B1%5D.value=SYNTHETIC_SECRET_KEY";
+
+        String result = servlet.getCleanQueryString("addObjectStoragePool", queryString, params);
+
+        Assert.assertEquals("command=addObjectStoragePool", result);
+        Assert.assertFalse(result.contains("SYNTHETIC_SECRET_KEY"));
+    }
+
+    @Test
+    public void shouldKeepOrdinaryQueryString() {
+        Map<String, String[]> params = new HashMap<>();
+        String queryString = "command=listZones&response=json";
+
+        String result = servlet.getCleanQueryString("listZones", queryString, params);
+
+        Assert.assertEquals(queryString, result);
+    }
+
+    @Test
+    public void shouldLogDuplicateParameterNameAndCountWithoutValues() {
+        Logger originalLogger = ApiServlet.LOGGER;
+        Logger logger = Mockito.mock(Logger.class);
+        ApiServlet.LOGGER = logger;
+        Map<String, String[]> params = new HashMap<>();
+        params.put("details[1].value", new String[] {"SYNTHETIC_SECRET_ONE", "SYNTHETIC_SECRET_TWO"});
+
+        try {
+            servlet.checkSingleQueryParameterValue(params);
+
+            ArgumentCaptor<String> message = ArgumentCaptor.forClass(String.class);
+            Mockito.verify(logger).warn(message.capture());
+            Assert.assertTrue(message.getValue().contains("details[1].value"));
+            Assert.assertTrue(message.getValue().contains("2 values"));
+            Assert.assertFalse(message.getValue().contains("SYNTHETIC_SECRET_ONE"));
+            Assert.assertFalse(message.getValue().contains("SYNTHETIC_SECRET_TWO"));
+        } finally {
+            ApiServlet.LOGGER = originalLogger;
+        }
+    }
 }
diff --git a/ui/src/utils/apiError.js b/ui/src/utils/apiError.js
new file mode 100644
index 000000000000..4fed774771fb
--- /dev/null
+++ b/ui/src/utils/apiError.js
@@ -0,0 +1,56 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+function cleanLogValue (value) {
+  if (typeof value !== 'string') {
+    return value
+  }
+  return value.replace(/[\n\r\t]/g, '_').slice(0, 256)
+}
+
+function getCommand (config) {
+  if (config?.params?.command) {
+    return config.params.command
+  }
+
+  const data = config?.data
+  if (typeof URLSearchParams !== 'undefined' && data instanceof URLSearchParams) {
+    return data.get('command')
+  }
+  if (typeof data === 'string') {
+    return new URLSearchParams(data).get('command')
+  }
+}
+
+export function getSafeApiErrorDetails (error) {
+  const response = error?.response
+  const config = response?.config || error?.config
+  const method = cleanLogValue(config?.method)
+
+  return {
+    name: cleanLogValue(error?.name),
+    code: cleanLogValue(error?.code),
+    status: response?.status,
+    statusText: cleanLogValue(response?.statusText),
+    method: typeof method === 'string' ? method.toUpperCase() : method,
+    command: cleanLogValue(getCommand(config))
+  }
+}
+
+export function logApiError (error) {
+  console.error('CloudStack API request failed', getSafeApiErrorDetails(error))
+}
diff --git a/ui/src/utils/plugins.js b/ui/src/utils/plugins.js
index 729cef84d021..0ca292e92bf0 100644
--- a/ui/src/utils/plugins.js
+++ b/ui/src/utils/plugins.js
@@ -23,6 +23,7 @@ import eventBus from '@/config/eventBus'
 import store from '@/store'
 import { sourceToken } from '@/utils/request'
 import { toLocalDate, toLocaleDate } from '@/utils/date'
+import { logApiError } from '@/utils/apiError'
 
 export const pollJobPlugin = {
   install (app) {
@@ -217,7 +218,7 @@ export const pollJobPlugin = {
 export const notifierPlugin = {
   install (app) {
     app.config.globalProperties.$notifyError = function (error) {
-      console.log(error)
+      logApiError(error)
       var msg = i18n.global.t('message.request.failed')
       var desc = ''
       if (error && error.response) {
diff --git a/ui/src/utils/request.js b/ui/src/utils/request.js
index 2317aac04465..3c75d636f096 100644
--- a/ui/src/utils/request.js
+++ b/ui/src/utils/request.js
@@ -24,6 +24,7 @@ import notification from 'ant-design-vue/es/notification'
 import { CURRENT_PROJECT } from '@/store/mutation-types'
 import { i18n } from '@/locales'
 import store from '@/store'
+import { logApiError } from '@/utils/apiError'
 
 let source
 const service = axios.create({
@@ -33,8 +34,8 @@ const service = axios.create({
 const err = (error) => {
   const response = error.response
   let countNotify = store.getters.countNotify
+  logApiError(error)
   if (response) {
-    console.log(response)
     if (response.status === 403) {
       const data = response.data
       countNotify++
diff --git a/ui/src/views/infra/AddObjectStorage.vue b/ui/src/views/infra/AddObjectStorage.vue
index a6f1d425e355..8c206ffb9d07 100644
--- a/ui/src/views/infra/AddObjectStorage.vue
+++ b/ui/src/views/infra/AddObjectStorage.vue
@@ -87,7 +87,7 @@
             <a-input v-model:value="form.accessKey" />
           </a-form-item>
           <a-form-item name="secretKey" ref="secretKey" :label="$t('label.secret.key')">
-            <a-input v-model:value="form.secretKey" />
+            <a-input-password v-model:value="form.secretKey" autocomplete="off" />
           </a-form-item>
           <a-form-item name="size" ref="size">
             <template #label>
diff --git a/ui/tests/unit/utils/apiError.spec.js b/ui/tests/unit/utils/apiError.spec.js
new file mode 100644
index 000000000000..68aa62e35460
--- /dev/null
+++ b/ui/tests/unit/utils/apiError.spec.js
@@ -0,0 +1,112 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import { getSafeApiErrorDetails, logApiError } from '@/utils/apiError'
+
+describe('API error logging', () => {
+  const accessKey = 'SYNTHETIC_ACCESS_KEY'
+  const secretKey = 'SYNTHETIC_SECRET_KEY'
+  const sessionKey = 'SYNTHETIC_SESSION_KEY'
+
+  function createAxiosError (data) {
+    return {
+      name: 'Error',
+      code: 'ERR_BAD_RESPONSE',
+      isAxiosError: true,
+      response: {
+        status: 500,
+        statusText: 'Internal Server Error',
+        data: {
+          errorresponse: {
+            errortext: secretKey
+          }
+        },
+        config: {
+          method: 'post',
+          url: '/',
+          data
+        }
+      }
+    }
+  }
+
+  it('keeps useful POST failure metadata without request or response secrets', () => {
+    const data = new URLSearchParams()
+    data.append('command', 'addObjectStoragePool')
+    data.append('details[0].value', accessKey)
+    data.append('details[1].value', secretKey)
+    data.append('sessionkey', sessionKey)
+    const error = createAxiosError(data.toString())
+
+    const details = getSafeApiErrorDetails(error)
+    const serializedDetails = JSON.stringify(details)
+
+    expect(details).toEqual({
+      name: 'Error',
+      code: 'ERR_BAD_RESPONSE',
+      status: 500,
+      statusText: 'Internal Server Error',
+      method: 'POST',
+      command: 'addObjectStoragePool'
+    })
+    expect(serializedDetails).not.toContain(accessKey)
+    expect(serializedDetails).not.toContain(secretKey)
+    expect(serializedDetails).not.toContain(sessionKey)
+  })
+
+  it('logs only the safe failure summary', () => {
+    const data = new URLSearchParams()
+    data.append('command', 'addObjectStoragePool')
+    data.append('details[1].value', secretKey)
+    const error = createAxiosError(data.toString())
+    const consoleError = jest.spyOn(console, 'error').mockImplementation(() => {})
+
+    try {
+      logApiError(error)
+
+      expect(consoleError).toHaveBeenCalledWith('CloudStack API request failed', {
+        name: 'Error',
+        code: 'ERR_BAD_RESPONSE',
+        status: 500,
+        statusText: 'Internal Server Error',
+        method: 'POST',
+        command: 'addObjectStoragePool'
+      })
+      expect(JSON.stringify(consoleError.mock.calls)).not.toContain(secretKey)
+    } finally {
+      consoleError.mockRestore()
+    }
+  })
+
+  it('does not copy GET parameters into the safe failure summary', () => {
+    const error = createAxiosError()
+    error.response.config.method = 'get'
+    error.response.config.params = {
+      command: 'addObjectStoragePool',
+      accesskey: accessKey,
+      secretkey: secretKey,
+      sessionkey: sessionKey
+    }
+
+    const serializedDetails = JSON.stringify(getSafeApiErrorDetails(error))
+
+    expect(serializedDetails).toContain('addObjectStoragePool')
+    expect(serializedDetails).not.toContain(accessKey)
+    expect(serializedDetails).not.toContain(secretKey)
+    expect(serializedDetails).not.toContain(sessionKey)
+  })
+})
diff --git a/ui/tests/unit/views/infra/AddObjectStorage.spec.js b/ui/tests/unit/views/infra/AddObjectStorage.spec.js
index 6ee541761102..b1d5c4ff89c8 100644
--- a/ui/tests/unit/views/infra/AddObjectStorage.spec.js
+++ b/ui/tests/unit/views/infra/AddObjectStorage.spec.js
@@ -17,6 +17,7 @@
 
 import mockAxios from '../../../mock/mockAxios'
 import AddObjectStorage from '@/views/infra/AddObjectStorage'
+import { mount } from '@vue/test-utils'
 
 jest.mock('axios', () => mockAxios)
 jest.mock('@/vue-app', () => ({
@@ -68,4 +69,31 @@ describe('Views > infra > AddObjectStorage.vue', () => {
 
     await expect(AddObjectStorage.methods.addObjectStore({})).rejects.toBe(error)
   })
+
+  it('masks the object storage secret key', () => {
+    const wrapper = mount(AddObjectStorage, {
+      props: {
+        resource: {}
+      },
+      global: {
+        mocks: {
+          $getApiParams: jest.fn(() => ({
+            name: {},
+            provider: {},
+            url: {},
+            size: {}
+          })),
+          $t: key => key
+        },
+        provide: {
+          parentFetchData: jest.fn()
+        }
+      }
+    })
+
+    const secretKeyInput = wrapper.find('input[type="password"]')
+
+    expect(secretKeyInput.exists()).toBe(true)
+    expect(secretKeyInput.attributes('autocomplete')).toBe('off')
+  })
 })

From fe572b38c0fa4676d3730c7c3c6ba52f3fb63e54 Mon Sep 17 00:00:00 2001
From: Dogface2k <100990646+Dogface2k@users.noreply.github.com>
Date: Sun, 2 Aug 2026 17:35:17 +0100
Subject: [PATCH 3/3] API: centralize credential-safe request diagnostics

---
 .../main/java/com/cloud/api/ApiServlet.java   |  6 ++---
 .../java/com/cloud/api/ApiServletTest.java    | 23 -------------------
 ui/src/utils/apiError.js                      |  4 ++--
 ui/tests/unit/utils/apiError.spec.js          | 15 ++++++++++++
 .../unit/views/infra/AddObjectStorage.spec.js |  2 +-
 5 files changed, 21 insertions(+), 29 deletions(-)

diff --git a/server/src/main/java/com/cloud/api/ApiServlet.java b/server/src/main/java/com/cloud/api/ApiServlet.java
index abd328cf3d6f..9f9deb0fa8f9 100644
--- a/server/src/main/java/com/cloud/api/ApiServlet.java
+++ b/server/src/main/java/com/cloud/api/ApiServlet.java
@@ -197,11 +197,11 @@ public void run() {
         });
     }
 
-    protected void checkSingleQueryParameterValue(Map<String, String[]> params) {
+    private void checkSingleQueryParameterValue(Map<String, String[]> params) {
         params.forEach((k, v) -> {
             if (v.length > 1) {
-                String message = String.format("Query parameter '%s' has %d values. Only the last value will be respected. " +
-                    "It is advised to pass only a single parameter", saveLogString(k), v.length);
+                String message = String.format("Query parameter '%s' has multiple values %s. Only the last value will be respected." +
+                    "It is advised to pass only a single parameter", k, Arrays.toString(v));
                 LOGGER.warn(message);
             }
         });
diff --git a/server/src/test/java/com/cloud/api/ApiServletTest.java b/server/src/test/java/com/cloud/api/ApiServletTest.java
index 1a18c00225ae..1470979f2d2a 100644
--- a/server/src/test/java/com/cloud/api/ApiServletTest.java
+++ b/server/src/test/java/com/cloud/api/ApiServletTest.java
@@ -34,13 +34,11 @@
 import org.apache.cloudstack.api.command.admin.config.ListCfgsByCmd;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
-import org.apache.logging.log4j.Logger;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
@@ -521,25 +519,4 @@ public void shouldKeepOrdinaryQueryString() {
         Assert.assertEquals(queryString, result);
     }
 
-    @Test
-    public void shouldLogDuplicateParameterNameAndCountWithoutValues() {
-        Logger originalLogger = ApiServlet.LOGGER;
-        Logger logger = Mockito.mock(Logger.class);
-        ApiServlet.LOGGER = logger;
-        Map<String, String[]> params = new HashMap<>();
-        params.put("details[1].value", new String[] {"SYNTHETIC_SECRET_ONE", "SYNTHETIC_SECRET_TWO"});
-
-        try {
-            servlet.checkSingleQueryParameterValue(params);
-
-            ArgumentCaptor<String> message = ArgumentCaptor.forClass(String.class);
-            Mockito.verify(logger).warn(message.capture());
-            Assert.assertTrue(message.getValue().contains("details[1].value"));
-            Assert.assertTrue(message.getValue().contains("2 values"));
-            Assert.assertFalse(message.getValue().contains("SYNTHETIC_SECRET_ONE"));
-            Assert.assertFalse(message.getValue().contains("SYNTHETIC_SECRET_TWO"));
-        } finally {
-            ApiServlet.LOGGER = originalLogger;
-        }
-    }
 }
diff --git a/ui/src/utils/apiError.js b/ui/src/utils/apiError.js
index 4fed774771fb..356a55c5b703 100644
--- a/ui/src/utils/apiError.js
+++ b/ui/src/utils/apiError.js
@@ -17,7 +17,7 @@
 
 function cleanLogValue (value) {
   if (typeof value !== 'string') {
-    return value
+    return undefined
   }
   return value.replace(/[\n\r\t]/g, '_').slice(0, 256)
 }
@@ -44,7 +44,7 @@ export function getSafeApiErrorDetails (error) {
   return {
     name: cleanLogValue(error?.name),
     code: cleanLogValue(error?.code),
-    status: response?.status,
+    status: Number.isInteger(response?.status) ? response.status : undefined,
     statusText: cleanLogValue(response?.statusText),
     method: typeof method === 'string' ? method.toUpperCase() : method,
     command: cleanLogValue(getCommand(config))
diff --git a/ui/tests/unit/utils/apiError.spec.js b/ui/tests/unit/utils/apiError.spec.js
index 68aa62e35460..600727f529e1 100644
--- a/ui/tests/unit/utils/apiError.spec.js
+++ b/ui/tests/unit/utils/apiError.spec.js
@@ -109,4 +109,19 @@ describe('API error logging', () => {
     expect(serializedDetails).not.toContain(secretKey)
     expect(serializedDetails).not.toContain(sessionKey)
   })
+
+  it('does not serialize unexpected objects from the error or request metadata', () => {
+    const secret = 'SYNTHETIC_NESTED_SECRET'
+    const error = createAxiosError()
+    error.name = { secret }
+    error.code = { secret }
+    error.response.status = { secret }
+    error.response.statusText = { secret }
+    error.response.config.method = { secret }
+    error.response.config.params = { command: { secret } }
+
+    const serializedDetails = JSON.stringify(getSafeApiErrorDetails(error))
+
+    expect(serializedDetails).not.toContain(secret)
+  })
 })
diff --git a/ui/tests/unit/views/infra/AddObjectStorage.spec.js b/ui/tests/unit/views/infra/AddObjectStorage.spec.js
index b1d5c4ff89c8..0d8933ac0086 100644
--- a/ui/tests/unit/views/infra/AddObjectStorage.spec.js
+++ b/ui/tests/unit/views/infra/AddObjectStorage.spec.js
@@ -43,7 +43,7 @@ describe('Views > infra > AddObjectStorage.vue', () => {
       'details[0].key': 'accesskey',
       'details[0].value': 'test-access-key',
       'details[1].key': 'secretkey',
-      'details[1].value': 'test-secret-key'
+      'details[1].value': 'test-secret+key&with=symbols'
     }
 
     await AddObjectStorage.methods.addObjectStore(params)