feat: enable applications to redact headers from recovery handler #29
Conversation
Codecov Report
@@ Coverage Diff @@
## main #29 +/- ##
==========================================
- Coverage 85.71% 85.66% -0.05%
==========================================
Files 24 24
Lines 1799 1800 +1
==========================================
Hits 1542 1542
- Misses 181 182 +1
Partials 76 76
Continue to review full report at Codecov.
|
middleware/recovery.go
Outdated
| // RemovedHeaders defines a list of HTTP headers that will be redacted from the | ||
| // request in the Recovery handler--if any logging or other output occurs, these | ||
| // headings will have value '<redacted>'. | ||
| var RemovedHeaders []string |
There was a problem hiding this comment.
Should we default this to []string{"Authorization"} as that header is always going to contain sensitive information? Users can always opt-out by setting it to an empty slice. Huma's approach is generally "batteries-included" and "do the right thing by default" when possible 😄
There was a problem hiding this comment.
Agreed! Fixed!
Super simple header redaction for the recovery handler before it parses the request to a string and sends it to the application.