Documentation
¶
Overview ¶
Package hostredact keeps a credential out of a message built from a host reference.
Three tiers refuse such references and each names the value it refused — helpers' host predicates, the endpoint rule, and the routing check that precedes a signed call. A reference carrying userinfo reaches all three, so redacting in one of them leaves the other two echoing, and a copy per tier is the shape this repo has already watched drift. Internal because it is message hygiene rather than a rule: nothing decides a verdict on what it returns.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Userinfo ¶
Userinfo replaces any userinfo in ref with a marker, so a message built from it cannot carry a credential.
Deliberately conservative, and deliberately NOT the rule: it runs on strings a parse has already refused, so it cannot assume they are well formed, and over-redacting a message costs nothing while under-redacting is the bug. It redacts at the FIRST reading in authorityStarts that finds an "@" rather than deciding on one reading — a credential any reader could see is one that must not reach a log. It looks only for an "@" in what could be the authority, which is why an "@" in a path is left alone.
The whole userinfo goes, not just the password. url.URL.Redacted keeps the username, which is right for a URL the caller owns — but these values arrive in a third-party manifest or an offer, where the username is as much the operator's secret as the password is.
Types ¶
This section is empty.
Source Files