BastiaanandClaude Opus 5.5 fe1391903a Redact credentials from logged HTTP request headers (#1054) ...

The controller HTTP access log and the express error log wrote the full
request headers at the http level, which both default log transports
keep. Clients send their access token in X-Access-Token or
Authorization: Bearer, so user and host tokens ended up in plain text
in controller and cluster logs, and the cluster log can be read back
over the API with core.log.query.

Mask the authorization, x-access-token, cookie and proxy-authorization
headers before logging.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-08 15:45:43 +01:00

..

controller

Redact credentials from logged HTTP request headers (#1054)

2026-10-08 15:45:43 +01:00

create

Migrate to ECMAScript Modules

2026-09-11 22:43:57 +02:00

ctl

Fix CLI config editor field names

2026-10-07 00:31:52 +00:00

file

Rename Ctl's usage of "control" to "ctl" (#1039)

2026-09-14 20:18:41 +02:00

host

Merge pull request #1053 from bbassie/fix/instance-save-name-traversal

2026-10-08 15:43:26 +01:00

integration

Merge pull request #1014 from bbassie/feature/patched-scenario

2026-10-06 16:37:16 +01:00

lib

Ignore errors in concurrent safeOutput test

2026-09-15 22:18:16 +02:00

manual

Migrate to ECMAScript Modules

2026-09-11 22:43:57 +02:00

messages

Add a request to mark hosts and the controller as needing a restart

2026-09-17 19:52:03 +00:00

common.js

Move slowTest and externalTest to test/common.js

2026-09-15 22:18:16 +02:00

mock.js

Add test helpers for plugin entrypoint functions

2026-10-08 05:11:02 +00:00

setup_logging.js

Setup logging transport in tests

2026-09-15 22:18:16 +02:00