Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tower and Actix: Filter out sensitive headers #665

Merged
merged 1 commit into from
Jun 27, 2024

Conversation

FSMaxB
Copy link
Contributor

@FSMaxB FSMaxB commented Jun 27, 2024

I've noticed that when constructing a sentry_core::protocol::Request, all headers are copied even if they are marked as sensitive.

This PR filters out sensitive headers.

@Swatinem Swatinem merged commit 172bcd4 into getsentry:master Jun 27, 2024
12 checks passed
@Swatinem
Copy link
Member

Thank you, I wasn’t aware so far that some headers are marked as sensitive and there is API for that.

@FSMaxB FSMaxB deleted the filter-sensitive-headers branch June 27, 2024 15:14
@FSMaxB
Copy link
Contributor Author

FSMaxB commented Jun 27, 2024

I'm not sure whether any are set as sensitive by default, but there is a middleware in tower-http that can be used to set headers as sensitive for example: https://docs.rs/tower-http/0.5.2/tower_http/sensitive_headers/index.html

@Ten0
Copy link
Contributor

Ten0 commented Jul 25, 2024

Looks like it might be better to instead write them as <sensitive>, so that people don't start wondering why their headers aren't sent when they in fact are but are just redacted from the logs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants