Redact HTTP headers on LoggingFeature

[nunomsantos]

Hi all,

Currently, LoggingFeature logs all HTTP headers of requests and responses. This might write sensitive data to the logs, like the Authorization header.
I was thinking of adding a configurable denylist of HTTP headers where one could specify, e.g., a comma separated list of headers whose value should be redacted before logging the request or response. We could also have a reasonable default denylist - does anyone know of other standard headers with sensitive data?

Would you consider this behavior valuable? I'm available to open a PR with this change if agreed.

[jansupol]

It could be useful. Feel free to provide a PR. Thanks.

[nunomsantos]

Hi, @senivam @jansupol. Can we close this issue?

[senivam]

I think yes, it was not linked to the PR to be closed automatically, so it was just forgotten. Thanks for reminding.