ResponseLogger prints raw request on cancellation
See original GitHub issueOn this line of code, we log the result of calling toString
on the request:
https://github.com/http4s/http4s/blob/a7e2fc108de12f7b111d688d33288c20f6a5a085/server/src/main/scala/org/http4s/server/middleware/ResponseLogger.scala#L70
This is dangerous, as it may end up logging sensitive information, ignoring the logHeaders
, logBody
, and redactHeadersWhen
options.
In our project, we’ve solved this by using Logger.logMessage
to log the request in this case, re-using the same options as for responses and introducing a constraint on the request type, A <: Message[F]
.
However, this may not be a good solution for getting this patched upstream, since it technically breaks the API (introducing a new type constraint), and re-uses the response logging configuration for requests.
Issue Analytics
- State:
- Created 3 years ago
- Comments:7 (5 by maintainers)
Top GitHub Comments
Also, much less gravely, while we’re at it,
canceled
is onel
. 😄Fixed by #3488.