Documentation
¶
Overview ¶
Package httplog logs HTTP traffic for --debug, with the secrets taken out.
It is a leaf package on purpose. Both the traffic to Google (whose request URL carries the Firebase API key and whose request body carries the password) and the traffic to fulfillmenttools (whose every request carries a bearer token) have to be logged by the same rules, and the two packages that own those clients — auth and client — must not import each other. The redaction lives here so that there is exactly one implementation of it.
What is removed ¶
The Authorization header, the ?key= query parameter, and any password, token or refresh token appearing as a JSON field or a form field. A --debug dump is the single most likely thing a user pastes into a bug report, so the bar is not "unlikely to leak" but "cannot".
Index ¶
Constants ¶
const Redacted = "[REDACTED]"
Redacted is what a secret is replaced with. It is deliberately conspicuous: a reader who sees it knows something was removed, rather than wondering whether the value really was empty.
Variables ¶
This section is empty.
Functions ¶
func Redact ¶
Redact removes from s the API key, any password or token it carries, and any of the extra secrets given that appear in it verbatim.
Very short extras are left alone: replacing every occurrence of a three-letter password would mangle the message into uselessness, and the message is the only thing the user has to go on.
Types ¶
type Transport ¶
type Transport struct {
// contains filtered or unexported fields
}
Transport logs every request it carries, and the response to it, to w.
It is a RoundTripper rather than a wrapper around the call sites because that is the only layer that sees what was *actually* sent: the headers another RoundTripper added, the body the generated client encoded. It changes nothing about the request.
Source Files