8000 HTTP endpoint class should not include Authorization headers in __str__ method · Issue #201 · profusion/sgqlc · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
HTTP endpoint class should not include Authorization headers in __str__ method #201
Open
@buffyg

Description

@buffyg

Logging Authorization headers leaks credentials into logs (for Bearer tokens, see https://www.rfc-editor.org/rfc/rfc6750.html#section-5.3, first item recommendation, "Safeguard bearer tokens"). Suggest converting base_headers into a dictionary comprehension that redacts 'Authorization' at sgqlc/endpoint/http.py:104, as in:

{k: v for k, v in self.base_headers.items() if k != "Authorization"}

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    0