cloudflare / cloudflare/cloudflared
💡cloudflared tunnel - do not log sensitive headers
Open
Priority: Normal
Type: Feature Request
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the feature you'd like**
When run with log level debug, cloudflared logs a line like the below, including all headers.
```
2024-12-16T15:04:35Z DBG GET HTTP/1.1 connIndex=1 content-length=0 event=1 headers= host= ingressRule=0 originService=http://: path=
```
The `Authorization` header is particularly sensitive and not one we want appearing in our logs. I'd like to be able to set logging to debug in production without concern for a potential security risk.
Contributor guide
Assessment
This issue has not been assessed yet.