Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 01:30 UTC
caddyhttp: Log empty value for typical password headers
Work around for common misconfiguration
Matthew Holt committed
Nov 22, 2021 at 11:31 UTC
7d5047c1f190421528695e1cc3a4ad71c97eb022
1 file changed
+7
-2
modules/caddyhttp/marshalers.go
+7
-2
@@ -17,6 +17,7 @@ package caddyhttp
17
import (
18
"crypto/tls"
19
"net/http"
20
+ "strings"
21
22
"go.uber.org/zap/zapcore"
23
)
@@ -39,6 +40,8 @@ func (r LoggableHTTPRequest) MarshalLogObject(enc zapcore.ObjectEncoder) error {
40
}
41
42
// LoggableHTTPHeader makes an HTTP header loggable with zap.Object().
43
+// Headers with potentially sensitive information (Cookie, Authorization,
44
+// and Proxy-Authorization) are logged with empty values.
45
type LoggableHTTPHeader http.Header
46
47
// MarshalLogObject satisfies the zapcore.ObjectMarshaler interface.
@@ -47,6 +50,10 @@ func (h LoggableHTTPHeader) MarshalLogObject(enc zapcore.ObjectEncoder) error {
50
return nil
51
}
52
for key, val := range h {
53
+ switch strings.ToLower(key) {
54
+ case "cookie", "authorization", "proxy-authorization":
55
+ val = []string{}
56
+ }
57
enc.AddArray(key, LoggableStringArray(val))
58
}
59
return nil
@@ -75,8 +82,6 @@ func (t LoggableTLSConnState) MarshalLogObject(enc zapcore.ObjectEncoder) error
82
enc.AddUint16("version", t.Version)
83
enc.AddUint16("cipher_suite", t.CipherSuite)
84
enc.AddString("proto", t.NegotiatedProtocol)
78
- // NegotiatedProtocolIsMutual is deprecated - it's always true
79
- enc.AddBool("proto_mutual", true)
85
enc.AddString("server_name", t.ServerName)
86
if len(t.PeerCertificates) > 0 {
87
enc.AddString("client_common_name", t.PeerCertificates[0].Subject.CommonName)