Leaking of credentials when using HTTP Basic auth about robotframework-requests

[lucagiove]

I agree there should be an hiding mechanism for such sensitive data.

[lucagiove]

Mainly the idea could be to have a parsing function that search in headers keys for well known authentication mechanism and remove the sensitive data from log.
So I expect to find in log example Authorization: 'value-has-been-redacted'
Probably by default the redaction is enabled and can be disabled maybe at debug logging level.
This solution should consider performance since logging is quite cpu intensive when lot of requests are issued.

[nestoracunablanco]

Hello @lucagiove , I wanted to confirm if I understood you correctly. I have just submitted a PR, which is currently incomplete. The PR focuses on retrieving header information, verifying the presence of an authorization key, and masking it with asterisks. This practice is commonly used to prevent logging of sensitive information.

In addition, I can also incorporate functionality to enable based on the log level. However, before expanding the code further in the PR, I would appreciate your feedback on whether I am proceeding in the right direction.