[Bugfix][Frontend] Redact hf_token in the non-default args log (#53625)
Signed-off-by: mhuzaifa3 <mhuzaifa3@outlook.com>
Moe Huzaifa committed
Aug 24, 2026 at 22:06 UTC
d3e2888c7588fe3a7be93606c7c626dbfd304d2e
2 files changed
+27
-4
tests/entrypoints/serve/utils/test_api_utils.py
+26
-3
@@ -120,11 +120,19 @@ class TestRedactSensitiveArgs:
120
API_KEY = "sk-test-secret-12345"
121
122
def test_redact_replaces_sensitive_values_only(self):
123
- args = {"api_key": self.API_KEY, "other": "visible"}
123
+ args = {"api_key": self.API_KEY, "hf_token": "hf_secret", "other": "visible"}
124
redacted = _redact_sensitive_args(args)
125
- assert redacted == {"api_key": "***", "other": "visible"}
125
+ assert redacted == {
126
+ "api_key": "***",
127
+ "hf_token": "***",
128
+ "other": "visible",
129
+ }
130
# original dict must not be mutated
127
- assert args == {"api_key": self.API_KEY, "other": "visible"}
131
+ assert args == {
132
+ "api_key": self.API_KEY,
133
+ "hf_token": "hf_secret",
134
+ "other": "visible",
135
+ }
136
137
def test_no_sensitive_fields_returns_original(self):
138
args = {"model_tag": "org/model", "other": "visible"}
@@ -147,3 +155,18 @@ class TestRedactSensitiveArgs:
155
# non-sensitive args are still logged
156
assert "org/model" in message
157
assert "qwen3_coder" in message
158
+
159
+ def test_hf_token_not_in_log(self, monkeypatch, caplog):
160
+ hf_token = "hf_TESTTOKENVALUE123"
161
+ non_default = {
162
+ "model_tag": "org/model",
163
+ "hf_token": hf_token,
164
+ "tool_call_parser": "qwen3_coder",
165
+ }
166
+ monkeypatch.setattr(api_utils, "get_non_default_args", lambda args: non_default)
167
+ with caplog.at_level("INFO", logger="vllm.entrypoints.serve.utils.api_utils"):
168
+ api_utils.log_non_default_args(args=Namespace())
169
+ message = caplog.text
170
+ assert hf_token not in message
171
+ assert "'hf_token': '***'" in message
172
+ assert "org/model" in message
vllm/entrypoints/serve/utils/api_utils.py
+1
-1
@@ -268,7 +268,7 @@ def jsonify_non_default_args(
268
269
270
# Fields whose values must never be logged verbatim.
271
-_SENSITIVE_ARG_FIELDS = frozenset({"api_key"})
271
+_SENSITIVE_ARG_FIELDS = frozenset({"api_key", "hf_token"})
272
273
274
def _redact_sensitive_args(args: dict[str, Any]) -> dict[str, Any]: