Skip to content

Query not hidden in DefaultClientResponse checkpoint #36502

Description

@joachimm

I get the following output when logging my errors. my apiKey is on full display, I can't use x-api-key header (I don't control the endpoint).
Error has been observed at the following site(s):
*__checkpoint ⇢ Body from POST https://api.example.com/resource?apiKey=[apiKey] [DefaultClientResponse]

When debugging this seems to be the source:

httpResponse, this.strategies, logPrefix, httpMethod.name() + " " + url,

The function:
WebClientUtils.getRequestDescription(this.request.getMethod(), this.request.getURI()),
() -> this.request);

Is used in most other checkpoint, notably:
DefaultClientResponseBuilder

	@Override
	public ClientResponse build() {

		ClientHttpResponse httpResponse = new BuiltClientHttpResponse(
				this.statusCode, this.headers, this.cookies, this.body, this.originalResponse);

		return new DefaultClientResponse(httpResponse, this.strategies,
				this.originalResponse != null ? this.originalResponse.logPrefix() : "",
				WebClientUtils.getRequestDescription(this.request.getMethod(), this.request.getURI()),
				() -> this.request);
	}

perhaps it is missing here as well? Or is this intentional?

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

in: webIssues in web modules (web, webmvc, webflux, websocket)status: backportedAn issue that has been backported to maintenance branchestype: bugA general bug

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions