fix(server/logging): sensitive response headers should not be logged (#…

…2039)
specklesystems · Feb 12, 2024 · 2983183 · 2983183
1 parent d836b64
commit 2983183
Showing 1 changed file with 14 additions and 1 deletion.
diff --git a/packages/server/logging/expressLogging.ts b/packages/server/logging/expressLogging.ts
@@ -111,7 +111,20 @@ export const LoggingExpressMiddleware = HttpLogger({
       return {
         statusCode: res.raw.statusCode,
         // Allowlist useful headers
-        headers: resRaw.raw.headers,
+        headers: Object.fromEntries(
+          Object.entries(resRaw.raw.headers).filter(
+            ([key]) =>
+              ![
+                'set-cookie',
+                'authorization',
+                'cf-connecting-ip',
+                'true-client-ip',
+                'x-real-ip',
+                'x-forwarded-for',
+                'x-original-forwarded-for'
+              ].includes(key.toLocaleLowerCase())
+          )
+        ),
         userId: auth?.userId
       }
     })