-
Notifications
You must be signed in to change notification settings - Fork 9.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Hide the value of sensitive query parameters in log #8242
Conversation
This is against the resolution of #7476
As it's a functional PR, I'm inclined to accept it. Will wait for a final take by @swankjesse Any follow up work could be wasted, so feel free to wait for a clearer signal. |
okhttp-logging-interceptor/src/test/java/okhttp3/logging/HttpLoggingInterceptorTest.kt
Show resolved
Hide resolved
okhttp-logging-interceptor/src/main/kotlin/okhttp3/logging/HttpLoggingInterceptor.kt
Outdated
Show resolved
Hide resolved
okhttp-logging-interceptor/src/main/kotlin/okhttp3/logging/HttpLoggingInterceptor.kt
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Works for me. I’ve got some naming changes I’d like you to make before I merge it!
okhttp-logging-interceptor/src/test/java/okhttp3/logging/HttpLoggingInterceptorTest.kt
Outdated
Show resolved
Hide resolved
okhttp-logging-interceptor/src/test/java/okhttp3/logging/HttpLoggingInterceptorTest.kt
Outdated
Show resolved
Hide resolved
@@ -903,6 +903,101 @@ class HttpLoggingInterceptorTest { | |||
.assertNoMoreLogs() | |||
} | |||
|
|||
@Suppress("INVISIBLE_MEMBER", "INVISIBLE_REFERENCE") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@MinhDang685 we run these tests in android also, which means they need to workaround internal methods. So I added this.
For logging interceptor: add an option to hide the value of sensitive query parameters in the request and response URL.
Inspired by the implementation of header redaction in
okhttp3.logging.HttpLoggingInterceptor
To use
Call the method
redactQueryParams(the list of query parameters to hide value, separated by commas)
from aokhttp3.logging.HttpLoggingInterceptor
instance. For example, to hide the value of "user" and "password" query parameters, useinterceptor.redactQueryParams("user", "password")
.http://localhost:8000/api/login?user=user1&authentication=basic&password=confidential_password"
http://localhost:8000/api/login?user=██&authentication=basic&password=██"