Any reason why sensitive data like URL and API Keys are exposed by RestException?

[eb-ib]

I noticed this at run time on 3.1.x but I also see it in the source code of 3.2.x: RestException exposes the URL and headers of the request.

The thing is that the headers that are shown include sensitive stuff like the API Key. I am wondering, is this intentional or an oversight?

open class RestException(val error: String, val description: String?, val response: HttpResponse): Exception("""
        $error${description?.let { " ($it)" } ?: ""}
        URL: ${response.request.url}
        Headers: ${response.request.headers.entries()}
        Http Method: ${response.request.method.value}
""".trimIndent()) {

[jan-tennert]

They should probably be masked. Can you create an feature request? Will look at it later

[jan-tennert]

Also @eb-ib I agree that the apikey and Authorization header should be masked, but the URL doesn't seem very sensitive to me

[eb-ib]

@jan-tennert It might not be sensitive in the general sense, but perhaps the SDK user does want to keep it private for whichever reason.

Given that things like URLs of external services are usually static and generally do not change after the app starts up, when a RestException occurs at run time, I am not sure how useful it is to see the (fixed, static) URL in the stack trace.

[jan-tennert]

@eb-ib Right, in the past were some problems where the URL was replaced by localhost by Ktor for some reason, but maybe we can just show the first two characters and mask the rest
The URL parameters are pretty helpful for debugging though.