I'd be happy to merge a pull request that adds that functionality. I think it is a sensible addition. I'm wondering what the best interface for that would be, though.

I think the most versatile would be something where the toolbelt accepts a function. It calls the function with request_headers, request_body, response_headers, and response_body as parameters and (where the headers values are dictionaries, the body values are bytes) and receives those back modified (or not) and uses the new values for display.

That would allow users to do whatever level of sanitizing they want.

I'm wondering if it makes sense to include the URLs too since people might consider there to be sensitive information there.

One part of me wishes that it were easy to "clone" a Response object from requests so we could just pass that in, but it isn't.

I can see if I get the time to implement something. I do believe it would be useful with a "default" implementation that does something reasonably sane, but with the option of supplying your own sanitizer.

If I make a default sanitizer, should it be enabled by default, or should the default behavior be to not do any sanitizing at all? I guess the principle of least surprise dictates that there should be no sanitizing by default.

Hi again.

I have had a go at this now, and I don't think a common function to handle both request and response will work with the current code. If we had a simple way to clone a Response object then we could just manipulate that, but since that is not possible and the code for handling request and response is split the single function won't work.

If we start talking about multiple functions, then I think it makes sense to send in an object that implements a suitable interface. We can then have two implementations, one that does nothing and is default, and one that redacts the headers we consider risky. The user is free to make their own implementation and pass that in instead.

It would make the implementation quite a bit easier, although I appreciate that it feels a bit more enterprisy 🙂

I will start working in this direction, let me know if you don't like it. I hope to have something for you to review either today or tomorrow.