Fix JWT tokens appearing in task logs

[sunank200]

• log only dag_id, task_id, run_id, log_path so the JWT token is never passed to the logger.
• Extend redact_jwt structlog processor to redact JWTs inside Pydantic-like objects (model_dump) and to replace token key values with *** so any workload-like object logged elsewhere is safe.

closes: #62773

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Made-with: Cursor

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[zach-overflow]

You could keep the same logging statement here and instead set the JWT-containing attribute as a pydantic.SecretStr, which will by default redact the field from logs.

[eladkal]

Closing in favor of #62964

[sunank200]

• log only dag_id, task_id, run_id, log_path so the JWT token is never passed to the logger.
• Extend redact_jwt structlog processor to redact JWTs inside Pydantic-like objects (model_dump) and to replace token key values with *** so any workload-like object logged elsewhere is safe.

closes: #62773

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Made-with: Cursor

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[zach-overflow]

You could keep the same logging statement here and instead set the JWT-containing attribute as a pydantic.SecretStr, which will by default redact the field from logs.

[eladkal]

Closing in favor of #62964

[sunank200]

• log only dag_id, task_id, run_id, log_path so the JWT token is never passed to the logger.
• Extend redact_jwt structlog processor to redact JWTs inside Pydantic-like objects (model_dump) and to replace token key values with *** so any workload-like object logged elsewhere is safe.

closes: #62773

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Made-with: Cursor

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[zach-overflow]

You could keep the same logging statement here and instead set the JWT-containing attribute as a pydantic.SecretStr, which will by default redact the field from logs.

[eladkal]

Closing in favor of #62964

[sunank200]

• log only dag_id, task_id, run_id, log_path so the JWT token is never passed to the logger.
• Extend redact_jwt structlog processor to redact JWTs inside Pydantic-like objects (model_dump) and to replace token key values with *** so any workload-like object logged elsewhere is safe.

closes: #62773

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Made-with: Cursor

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[zach-overflow]

You could keep the same logging statement here and instead set the JWT-containing attribute as a pydantic.SecretStr, which will by default redact the field from logs.

[eladkal]

Closing in favor of #62964

[sunank200]

• log only dag_id, task_id, run_id, log_path so the JWT token is never passed to the logger.
• Extend redact_jwt structlog processor to redact JWTs inside Pydantic-like objects (model_dump) and to replace token key values with *** so any workload-like object logged elsewhere is safe.

closes: #62773

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Made-with: Cursor

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[zach-overflow]

You could keep the same logging statement here and instead set the JWT-containing attribute as a pydantic.SecretStr, which will by default redact the field from logs.

[eladkal]

Closing in favor of #62964

[sunank200]

• log only dag_id, task_id, run_id, log_path so the JWT token is never passed to the logger.
• Extend redact_jwt structlog processor to redact JWTs inside Pydantic-like objects (model_dump) and to replace token key values with *** so any workload-like object logged elsewhere is safe.

closes: #62773

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Made-with: Cursor

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[zach-overflow]

You could keep the same logging statement here and instead set the JWT-containing attribute as a pydantic.SecretStr, which will by default redact the field from logs.

[eladkal]

Closing in favor of #62964

[sunank200]

• log only dag_id, task_id, run_id, log_path so the JWT token is never passed to the logger.
• Extend redact_jwt structlog processor to redact JWTs inside Pydantic-like objects (model_dump) and to replace token key values with *** so any workload-like object logged elsewhere is safe.

closes: #62773

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Made-with: Cursor

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[zach-overflow]

You could keep the same logging statement here and instead set the JWT-containing attribute as a pydantic.SecretStr, which will by default redact the field from logs.

[eladkal]

Closing in favor of #62964

[sunank200]

• log only dag_id, task_id, run_id, log_path so the JWT token is never passed to the logger.
• Extend redact_jwt structlog processor to redact JWTs inside Pydantic-like objects (model_dump) and to replace token key values with *** so any workload-like object logged elsewhere is safe.

closes: #62773

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Made-with: Cursor

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[zach-overflow]

You could keep the same logging statement here and instead set the JWT-containing attribute as a pydantic.SecretStr, which will by default redact the field from logs.

[eladkal]

Closing in favor of #62964