Passing in `webhooksite_session` cookie causes entire cookie header not to display about webhook.site

[fredsted]

It's to avoid leaking the authentication cookies of Webhook.site users, although I would say it could be done in a more elegant way.

[srithon]

It's to avoid leaking the authentication cookies of Webhook.site users, although I would say it could be done in a more elegant way.

Got it, got it, thanks, I didn't consider that webhook URLs are meant to be publicly shareable. I completely understand that this isn't a priority, but it would be cool if instead of dropping the Cookie header entirely, you instead replaced the webhooksite_session value with "<redacted>". I attempted to draft some code for this but as I'm not familiar with PHP (and the cloud codebase may differ here), it may be incorrect:

./app/Storage/Request.php
@@ -1,9 +1,11 @@
 use Carbon\Carbon;
 use Illuminate\Http\Request as HttpRequest;
 use Ramsey\Uuid\Uuid;
 
+use Symfony\Component\HttpFoundation\HeaderUtils;
+
 class Request extends Entity
 {
     /**
      * @param $tokenId
      * @param null $requestId
@@ -22,10 +24,18 @@
      * @param HttpRequest $httpRequest
      * @return Request
      */
     public static function createFromRequest(HttpRequest $httpRequest)
     {
+        $cookies = $httpRequest->cookies();
+        $auth_token_name = 'webhooksite_session';
+        if ($cookies->get($auth_token_name)) {
+            $cookies->set($auth_token_name, '<redacted>');
+            $redactedCookiesVal = HeaderUtils::toString($cookies->all(), '; ');
+            $httpRequest->headers->set('cookie', $redactedCookiesVal);
+        }
+
         $request = new self([
             'uuid' => Uuid::uuid4()->toString(),
             'token_id' => $httpRequest->tokenId,
             'ip' => $httpRequest->ip(),
             'hostname' => $httpRequest->getHost(),

While this approach does have the downside of normalizing the HTTP header value (removing whitespace and potentially also normalizing the case), I would still prefer the behavior over just dropping the Cookie header entirely. However, since this is an issue most people wouldn't be concerned with, I understand if you'd like to avoid the additional complexity/capacity for bugs altogether.