25 lines
811 B
Go
25 lines
811 B
Go
package secrets
|
|
|
|
import "strings"
|
|
|
|
const Redacted = "REDACTED"
|
|
|
|
// RedactDiagnosticFields removes known credential/header values before a
|
|
// diagnostics boundary. Callers must still avoid passing raw values at all.
|
|
func RedactDiagnosticFields(fields map[string]string) map[string]string {
|
|
redacted := make(map[string]string, len(fields))
|
|
for key, value := range fields {
|
|
if isSensitiveDiagnosticField(key) {
|
|
redacted[key] = Redacted
|
|
continue
|
|
}
|
|
redacted[key] = value
|
|
}
|
|
return redacted
|
|
}
|
|
|
|
func isSensitiveDiagnosticField(key string) bool {
|
|
key = strings.ToLower(strings.TrimSpace(key))
|
|
return key == "authorization" || key == "proxy-authorization" || strings.Contains(key, "secret") || strings.Contains(key, "token") || strings.Contains(key, "password") || strings.Contains(key, "credential")
|
|
}
|