{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/6309","repository_url":"https://api.github.com/repos/spring-projects/spring-boot","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/6309/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/6309/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/6309/events","html_url":"https://github.com/spring-projects/spring-boot/issues/6309","id":163510291,"number":6309,"title":"Enhance WebRequestTraceFilter to allow excluding capture of certain request headers (e.g. Authorization)","user":{"login":"imberda","id":1518082,"avatar_url":"https://avatars.githubusercontent.com/u/1518082?v=3","gravatar_id":"","url":"https://api.github.com/users/imberda","html_url":"https://github.com/imberda","followers_url":"https://api.github.com/users/imberda/followers","following_url":"https://api.github.com/users/imberda/following{/other_user}","gists_url":"https://api.github.com/users/imberda/gists{/gist_id}","starred_url":"https://api.github.com/users/imberda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imberda/subscriptions","organizations_url":"https://api.github.com/users/imberda/orgs","repos_url":"https://api.github.com/users/imberda/repos","events_url":"https://api.github.com/users/imberda/events{/privacy}","received_events_url":"https://api.github.com/users/imberda/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/waiting-for-feedback","name":"waiting-for-feedback","color":"fef2c0"},{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/waiting-for-triage","name":"waiting-for-triage","color":"ededed"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-07-02T09:23:51Z","updated_at":"2016-07-03T23:01:10Z","closed_at":null,"body":"The WebRequestTraceFilter (which captures the data for the Spring boot trace actuator feature) currently captures _all_ request headers. It's currently not possible to configure / provide a list of headers which should not be captured. \r\n\r\nThe most common example of where it may be required to exclude a header is \"Authorization. If this header is captured (and then displayed) then operations personel will have access to user credentials.\r\n\r\nI would propose adding a collection to TraceProperties - something like \"excludedHeaders\" which is then checked against within WebRequestTraceFilter.getRequestHeaders() WebRequestTraceFilter.getResponseHeaders().\r\n\r\nIf you agree with the enhancement I'd be happy supply a pull request in the coming days. Thanks."},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/comments/230180750","html_url":"https://github.com/spring-projects/spring-boot/issues/6309#issuecomment-230180750","issue_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/6309","id":230180750,"user":{"login":"imberda","id":1518082,"avatar_url":"https://avatars.githubusercontent.com/u/1518082?v=3","gravatar_id":"","url":"https://api.github.com/users/imberda","html_url":"https://github.com/imberda","followers_url":"https://api.github.com/users/imberda/followers","following_url":"https://api.github.com/users/imberda/following{/other_user}","gists_url":"https://api.github.com/users/imberda/gists{/gist_id}","starred_url":"https://api.github.com/users/imberda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imberda/subscriptions","organizations_url":"https://api.github.com/users/imberda/orgs","repos_url":"https://api.github.com/users/imberda/repos","events_url":"https://api.github.com/users/imberda/events{/privacy}","received_events_url":"https://api.github.com/users/imberda/received_events","type":"User","site_admin":false},"created_at":"2016-07-03T23:01:09Z","updated_at":"2016-07-03T23:01:09Z","body":"I take your point around it being a bit complex. In my case our ops guys generally find the headers interesting (for example X-Forwarded-For).\r\n\r\nMight it be possible to add @ConditionalOnMissingClass to the filter bean definition in TraceWebFilterAutoConfiguration and make the getRequestHeaders() method protected? That way if people want to customise they can define their own versions of the filter."}}
{"actor":{"display_login":"imberda"}}