Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

curl request logger doesn't hide sensitive header if logRequestBody = true #1390

Closed
evis opened this issue Apr 7, 2022 · 0 comments · Fixed by #1391
Closed

curl request logger doesn't hide sensitive header if logRequestBody = true #1390

evis opened this issue Apr 7, 2022 · 0 comments · Fixed by #1391

Comments

@evis
Copy link

evis commented Apr 7, 2022

https://scastie.scala-lang.org/zIFXMepwREOGGiV3e52kzQ

import sttp.client3._
import sttp.client3.logging.LogLevel
import sttp.client3.logging.slf4j.Slf4jLoggingBackend

val sensitiveHeader = "sensitive"

basicRequest
  .get(uri"http://google.com")
  .header(sensitiveHeader, "NOT IGNORED")
  .send(
    Slf4jLoggingBackend(
      HttpURLConnectionBackend(),
      beforeCurlInsteadOfShow = true,
      logRequestBody = true,
      sensitiveHeaders = Set(sensitiveHeader),
      beforeRequestSendLogLevel = LogLevel.Info
    )
  )

Output:

[run-main-0] INFO sttp.client3.logging.slf4j.Slf4jLoggingBackend - Sending request: curl \
  --request GET \
  --url 'http://google.com' \
  --header 'sensitive: NOT IGNORED' \
  --location \
  --max-redirs 32

Expected: header "sensitive" is not logged.

Actual: header "sensitive" is logged.

@evis evis changed the title curl request logging doesn't hide sensitive header if logRequestBody = true curl request logger doesn't hide sensitive header if logRequestBody = true Apr 7, 2022
ak0rz added a commit to ak0rz/sttp that referenced this issue Apr 7, 2022
Fixes softwaremill#1390.

Looks like sensitive headers argument was just missing.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant