Documentation
¶
Overview ¶
Package logredact removes credentials from log output. Handler wraps the final slog handler, so every record is scrubbed whichever call site wrote it: a URL with ?X-Plex-Token=…, an error that quotes a request, a header dump or an attribute named "password". Call-site redaction stays useful (it keeps the shape of a value readable); this is the backstop.
It recognises credentials by name (query parameters, JSON keys, header names and attribute keys, compared case-insensitively ignoring '-' and '_' and after URL-decoding, so %58-Plex-Token is X-Plex-Token), by position (user:password@ in URLs, Bearer/Basic credentials) and by the prefixes of Ether's own credentials. Anything else passes through unchanged.
Index ¶
Constants ¶
const Mask = "[redacted]"
Mask replaces a removed credential.
Variables ¶
This section is empty.
Functions ¶
func Handler ¶
Handler returns a slog.Handler that scrubs every record before next sees it: the message, attribute values (inside groups too) and attributes added with WithAttrs. Attributes whose key names a credential lose their value entirely.
Types ¶
This section is empty.
Source Files