A city permitting API returns bearer tokens to mobile clients. A developer proposes logging every Authorization header to CloudWatch Logs for easier debugging. What should the team do?
Select an answer to reveal the explanation.
Short Explanation
Bearer tokens are keys to the city vault—ship them only over HTTPS and keep them out of logs. Dumping Authorization headers into CloudWatch is a leak waiting to happen. Debug with redacted IDs, not live secrets.
Full Explanation
Tokens must travel only over TLS so they are not exposed in transit. Logging Authorization headers or bearer tokens to CloudWatch creates durable secret material outside the intended auth flow and is a common leak vector. Teams should redact or omit secrets from application logs. Moving to HTTP or embedding IAM keys in clients worsens exposure rather than fixing it.