Documentation
¶
Overview ¶
Package credential tells names and values that hold credentials: passwords, tokens, keys, signatures. The recording pipeline (har) leaves such requests out of the catalog; a capture keeps responses that hold them out of git and masks them in headers.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func InQuery ¶
InQuery reports a URL with a query parameter named as a credential that has a value (a signed or presigned URL, a link with its token), also in the fragment (an OAuth redirect's #access_token=), or with a JWT anywhere. A value shaped like a token under another name, or in the path, is not taken: the random names of stored files look the same.
func Key ¶
Key is Name for a key of a response body, whose value is checked too (Value): there "hash" alone does not count, as a content hash (of a file, a commit) is common in responses; password_hash still counts.
func MaskURL ¶
MaskURL masks the credentials in a URL, absolute or relative, keeping everything else as it is written: the value of every query parameter named as a credential (token=, signature=, X-Amz-Signature=) or shaped like one, the same in the fragment (an OAuth redirect's #access_token=, a route's #/reset?token=) or a fragment shaped like one as a whole, and with paths every path segment shaped like one (a reset link's token). mask turns a value into its masked form. changed reports whether anything was masked.
func MayHoldJWT ¶
MayHoldJWT reports whether v has "eyJ", with which every JWT starts: a quick test before JWT, also of a whole body. It looks for the J, which is rare in text, where a search for "eyJ" would stop at every e.
func Name ¶
Name reports whether the name of a parameter, key, form field or header holds a credential. A name is split into words at every character that is not a letter or digit and at camelCase boundaries (currentPassword, authToken, XSRFToken), so a credential word counts wherever it stands in the name.
Types ¶
This section is empty.
Source Files