Documentation
¶
Index ¶
- Constants
- Variables
- func ClassifyTransportFailure(err error) string
- func CopyKeySet(source map[string]struct{}) map[string]struct{}
- func HasSignedQuery(values url.Values, signedKeys map[string]struct{}) bool
- func MergeKeySets(sets ...map[string]struct{}) map[string]struct{}
- func RedactURLForError(rawURL string) string
- func RedactURLHostForError(rawURL string) string
- func SanitizeURLForLog(rawURL string, signedKeys, sensitiveKeys map[string]struct{}) string
- type TransportError
Constants ¶
const RedactedPlaceholder = "[REDACTED]"
RedactedPlaceholder replaces a URL that cannot be reduced to a safe form.
Variables ¶
var DefaultSensitiveQueryKeys = map[string]struct{}{
"x-amz-signature": {},
"x-amz-credential": {},
"x-amz-algorithm": {},
"x-amz-signedheaders": {},
"x-amz-security-token": {},
"signature": {},
"key-pair-id": {},
"policy": {},
"sig": {},
"token": {},
"access_token": {},
"id_token": {},
"refresh_token": {},
}
DefaultSensitiveQueryKeys identifies params that should be redacted in logs.
var DefaultSignedQueryKeys = map[string]struct{}{
"x-amz-signature": {},
"x-amz-credential": {},
"x-amz-algorithm": {},
"x-amz-signedheaders": {},
"signature": {},
"key-pair-id": {},
"policy": {},
"sig": {},
}
DefaultSignedQueryKeys identifies query params that indicate signed URLs.
Functions ¶
func ClassifyTransportFailure ¶ added in v1.260731.0
ClassifyTransportFailure returns a short, credential-free description of a transport failure so sanitized errors keep their diagnostic value.
func CopyKeySet ¶
CopyKeySet returns a shallow copy of a key set map.
func HasSignedQuery ¶
HasSignedQuery returns true when query contains a non-empty signing key value.
func MergeKeySets ¶
MergeKeySets returns a merged copy of all provided key sets.
func RedactURLForError ¶ added in v1.260731.0
RedactURLForError reduces a URL to scheme, host, and path. Userinfo, query values, and the fragment are dropped because presigned uploads carry their capability there. The path is kept because it identifies the operation.
func RedactURLHostForError ¶ added in v1.260731.0
RedactURLHostForError reduces a URL to scheme and host only. Use it when the path is itself a credential, as with Slack incoming webhooks.
func SanitizeURLForLog ¶
SanitizeURLForLog redacts sensitive URL fields while preserving shape.
Types ¶
type TransportError ¶ added in v1.260731.0
TransportError describes a failed request without repeating the request URL's credentials. Unwrap keeps errors.Is and errors.As usable on the cause.
func NewTransportError ¶ added in v1.260731.0
func NewTransportError(operation, safeURL string, err error) *TransportError
NewTransportError builds a sanitized transport error for an operation against safeURL, which must already have been reduced by one of the redact helpers.
func (*TransportError) Error ¶ added in v1.260731.0
func (e *TransportError) Error() string
Error returns the sanitized message. The wrapped cause is deliberately not interpolated: net/http renders the full request URL in its error text.
func (*TransportError) Unwrap ¶ added in v1.260731.0
func (e *TransportError) Unwrap() error
Unwrap exposes the underlying transport error for inspection.
Source Files