Prerequisites
Steps to reproduce
PowerShell 7.6 introduced WebRequest debug output that includes the HTTP request body. When the request body contains credential material, such as an OAuth2 client_secret, the value is written to the debug stream in clear text.
This appears to be a regression compared to PowerShell 7.5, where the same request did not emit the request body in this way.
Minimal repro:
$body = @{
client_id = 'REDACTED_CLIENT_ID'
grant_type = 'client_credentials'
client_secret = 'REDACTED_CLIENT_SECRET'
scope = 'openid'
}
Invoke-WebRequest `
-Uri 'https://example.invalid/oauth/token' `
-Method Post `
-ContentType 'application/x-www-form-urlencoded' `
-Body $body `
-DebugObserved with a real OAuth2 token request using application/x-www-form-urlencoded.
The relevant change appears related to:
Expected behavior
Invoke-WebRequest / Invoke-RestMethod should not write sensitive credential material to the debug stream in clear text.
For application/x-www-form-urlencoded request bodies, well-known sensitive fields should either be redacted or the body should be omitted by default.
Examples of fields that should be redacted include, but are not limited to:
- client_secret
- password
- access_token
- refresh_token
- id_token
- assertion
- code
- token
- secret
- api_key
- apikey
Expected debug output should look similar to:
DEBUG: WebRequest Detail
--- HEADERS
Content-Type: application/x-www-form-urlencoded
--- BODY
client_id=REDACTED_CLIENT_ID&grant_type=client_credentials&client_secret=REDACTED&scope=openid
Alternatively:
DEBUG: WebRequest Detail
--- BODY
<request body omitted because it may contain sensitive data>
A PowerShell version upgrade from 7.5 to 7.6 should not cause secrets that were previously not printed to appear in debug output.
Actual behavior
PowerShell 7.6 prints the request body to the debug stream. For OAuth2 client credentials requests, this includes the client_secret value.
Sanitized example from PowerShell 7.6.2:
DEBUG: WebRequest Detail
--- HEADERS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.17763; de-DE) PowerShell/7.6.2
Content-Type: application/x-www-form-urlencoded
--- BODY
client_id=REDACTED_CLIENT_ID&grant_type=client_credentials&client_secret=REDACTED_CLIENT_SECRET&scope=openid
This is security-sensitive because the PowerShell debug stream may be captured by:
- console scrollback
- PowerShell transcripts
- CI/CD logs
- automation logs
- centralized logging systems
- support bundles
- screen recordings
The behavior was not observed in PowerShell 7.5 with the same code path.
Error details
No exception is thrown.
The issue is unintended disclosure of sensitive request body values through the debug stream.
The problematic output format is:
DEBUG: WebRequest Detail
--- HEADERS
...
--- BODY
client_id=...&grant_type=client_credentials&client_secret=...&scope=openid
The request succeeds, but credential material is exposed in debug output.
Environment data
Paste output from:
$PSVersionTable
Name Value
---- -----
PSVersion 7.6.3
PSEdition Core
GitCommitId 7.6.3
OS Microsoft Windows 10.0.26200
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.4
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
Also reproduced/compared against:
PowerShell 7.5.x: request body was not emitted in the observed debug output
PowerShell 7.6.3: request body is emitted and includes client_secretVisuals
No response.
A sanitized text reproduction is included above. Real secrets, URLs, tenant identifiers, and customer-specific data have intentionally been removed.
Prerequisites
Steps to reproduce
PowerShell 7.6 introduced WebRequest debug output that includes the HTTP request body. When the request body contains credential material, such as an OAuth2 client_secret, the value is written to the debug stream in clear text.
This appears to be a regression compared to PowerShell 7.5, where the same request did not emit the request body in this way.
Minimal repro:
Observed with a real OAuth2 token request using application/x-www-form-urlencoded.
The relevant change appears related to:
Expected behavior
Actual behavior
Error details
Environment data
Visuals
No response.
A sanitized text reproduction is included above. Real secrets, URLs, tenant identifiers, and customer-specific data have intentionally been removed.