Hide authorization header values when logging
I can understand why it's useful to display the value of an authorization header for debugging purposes, but this is very insecure by default. In fact, I'm working on a plugin for pidgin right now, and I just accidentally leaked my credentials because the logger happily spit it out. This is problematic for pidgin, as we normally have to ask users to "nopaste" their debug window output and we would prefer that them having to change credentials wasn't a side effect of that.
Would you all be against a patch that changed the value of the the Authorization
header (only when logged) to something like <redacted>
or just *******
. Potentially with an option to re-enable displaying it directly.
If there were an option to enable it, the disabled value could instead be a hint to enable the setting. For example "<redacted see soup_session_enabled_passwords()>"` or something along those lines.