cloudflare / cloudflare/cloudflared

💡cloudflared tunnel - do not log sensitive headers

Open
#1,372 1 comment 2 reactions 0 assignees View on GitHub
Priority: Normal Type: Feature Request
Dominant language
Go
Stars
15.6k
Forks
1.4k
PR merge metrics
No merged PRs in 30d

Description

**Describe the feature you'd like**

When run with log level debug, cloudflared logs a line like the below, including all headers.

```
2024-12-16T15:04:35Z DBG GET HTTP/1.1 connIndex=1 content-length=0 event=1 headers= host= ingressRule=0 originService=http://: path=
```

The `Authorization` header is particularly sensitive and not one we want appearing in our logs. I'd like to be able to set logging to debug in production without concern for a potential security risk.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.