Open
Description
Hey,
when upping the log level to debug
I noticed that the Authorization
-header is logged.
It's probably coming from here, where the request is dumped: pkg/util/http/logroundtripper.go#L21
Example log line - 'TOKEN' is actually the secret as plain text:
{"level":"debug","msg":"Sending request: POST /api/annotations HTTP/1.1\r\nHost: SOME-HOST\r\nAuthorization: Bearer TOKEN\r\nContent-Type: application/json SOME-MORE-STUFF","service":"SERVICE","time":"TIME"}
Would it be possible to redact the value or is there any reason to actually log that?
Metadata
Metadata
Assignees
Labels
No labels