Remove API key from headers in error message

This was originally posted as a bug https://github.com/axios/axios/issues/4246 but the GitHub bot didn’t seem to like it. Trying again here as a feature request.

Describe the issue

I am catching the error responses from Axios when a request fails. I then use the error request to create logs, log to console or return to the browser. In many of these instances the error contains axios.defaults.headers.common.Authorization set before the request. I started going through deleting them before logging, but they are all over in the response and request, and {config} with the response and request. So far I have:

obj.config.headers.Authorization
obj.request._header
obj.response.request._header
obj.request._currentRequest._header

Likely more, but have stopped looking.

Ideally there would be a way to clean this up automatically so the outputs are safe to use anywhere.

To Reproduce

Any failed request

New feature.

Remove the Authorisation headers so error message can be used safely, with option to include them for debug.

Environment

• Axios Version [0.24.0]

[github-actions[bot]]

Hello! 👋

This issue is being automatically closed because it does not follow the issue template. Please read the issue template carefully and follow all of the instructions when opening a new issue.

Thanks

[jasonsaayman]

I still disagree, firstly you should not be logging the entire response in any use case ever, what should be done is you should log only the parts of the response that you would like to keep for traces and to identify errors. When logging the entire response you are actually creating multiple potential issues, you could be logging user data, you can be breaching GDPR and you can even be login their credentials as that request data is in there too.

Also realistically the above suggestion would not cover all use cases by a long stretch. People implement any key-value pair they want for the token sometimes, amazon re-writes the key values when under an API gateway and the list goes on so it would theoretically be impossible for us to strip all of the possible tokens and credentials from the response object.