[Security] Sanitize Cookie headers in debug logs#7511
[Security] Sanitize Cookie headers in debug logs#7511gonzaloriestra wants to merge 1 commit intomainfrom
Conversation
This PR enhances the `sanitizedHeadersOutput` utility to redact `Cookie` and `Set-Cookie` headers from debug logs. This prevents sensitive session data from being accidentally exposed when debug logging is enabled. Summary of changes: - Added `'cookie'` to the list of redacted keywords in `packages/cli-kit/src/private/node/api/headers.ts`. - Updated unit tests in `packages/cli-kit/src/private/node/api/headers.test.ts` to verify the redaction of cookie headers. Duplicate check: The query `gh pr list --repo Shopify/cli --state all --limit 200 --search 'label:"Jules" "Security" in:title' --json number,title,state,url,body,files` was not executable in this environment, but a search of git logs for "[Security]" PRs was performed. Closest prior PR: - [Security] Sanitize Cookie headers in debug logs (1076958) - This appears to be a previous attempt at the same issue, but I am implementing it on the current codebase which did not have these changes. How to test your changes? Run any command that performs a network request with cookies while debug logging is enabled (e.g. `SHOPIFY_CLI_LOG_LEVEL=debug shopify app dev`). Verify that `Cookie` or `Set-Cookie` headers are not visible in the console output. Alternatively, run the unit tests: `pnpm --filter @shopify/cli-kit vitest run src/private/node/api/headers.test.ts`
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
github-actions
Bot
added
the
no-changelog
1 participant
This PR enhances the
sanitizedHeadersOutpututility to redactCookieandSet-Cookieheaders from debug logs. This prevents sensitive session data from being accidentally exposed when debug logging is enabled.PR created automatically by Jules for task 16142315547275017735 started by @gonzaloriestra