Documentation
¶
Overview ¶
Package logredact removes credentials from log output. Handler wraps the final slog handler, so every record is scrubbed whichever call site wrote it: a URL with ?X-Plex-Token=…, an error that quotes a request, a header dump or an attribute named "password". Call-site redaction stays useful (it keeps the shape of a value readable); this is the backstop.
It recognises credentials by name (query parameters, JSON keys, header names and attribute keys, compared case-insensitively ignoring '-' and '_' and after URL-decoding, so %58-Plex-Token is X-Plex-Token), by position (user:password@ in URLs, Bearer/Basic credentials) and by the prefixes of Ether's own credentials. Anything else passes through unchanged.
Index ¶
Constants ¶
const Mask = "[redacted]"
Mask replaces a removed credential.
Variables ¶
This section is empty.
Functions ¶
func Handler ¶
Handler returns a slog.Handler that scrubs every record before next sees it: the message, attribute values (inside groups too) and attributes added with WithAttrs. Attributes whose key names a credential lose their value entirely.
func Sensitive ¶
Sensitive reports whether a parameter, header, JSON key or attribute key names a credential. Percent-encoded names are decoded first.
func TransportError ¶ added in v0.3.4
TransportError copies a net/http URL error through clean. If clean is nil, the URL is omitted entirely and prefix names the service. The underlying transport error is preserved so errors.Is and timeout checks still work.
Types ¶
This section is empty.
Source Files