Debug logs expose sensitive information
- Dominant language
- TypeScript
- Stars
- 4.8k
- Forks
- 716
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 10
Description
### Problem description
Enabling debug logs might be necessary to, well, debug some issues. While debugging, I noticed that `subchannel` trace logs expose e.g. an authorization header of requests:
```
2020-07-27T06:58:46.331Z | subchannel | Starting stream with headers
x-goog-api-client: gax/2.6.3 gapic/4.1.1 gl-node/14.4.0 grpc/1.1.3 gccl/4.1.1
google-cloud-resource-prefix: [REDACTED]
x-goog-request-params: [REDACTED]
authorization: Bearer [REDACTED]
```
I wanted to bring this to your attention as it might be wise to change this behavior, especially that sometimes we ask others to provide these logs and some might not notice.
### Reproduction steps
Just enable trace logs for subchannels and make an authenticated request.
### Environment
- OS name, version and architecture: all
- Node version: all
- Node installation method: all
- If applicable, compiler version: not applicable
- Package name and version: 1.1.3
Contributor guide
Assessment
This issue has not been assessed yet.