Skip to content

Feat: redact debug logging #357

Open
@jan-mrm

Description

@jan-mrm

Hey,

when upping the log level to debug I noticed that the Authorization-header is logged.

It's probably coming from here, where the request is dumped: pkg/util/http/logroundtripper.go#L21

Example log line - 'TOKEN' is actually the secret as plain text:

{"level":"debug","msg":"Sending request: POST /api/annotations HTTP/1.1\r\nHost: SOME-HOST\r\nAuthorization: Bearer TOKEN\r\nContent-Type: application/json SOME-MORE-STUFF","service":"SERVICE","time":"TIME"}

Would it be possible to redact the value or is there any reason to actually log that?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions