fix: Remove authorization header in middleware
__Rationale__
Debug logs in the middle ware (and potentially elsewhere) can cause authorization headers
(containing authentication tokens) to be accidentally leaked in the logs.
It's easy to just remove those headers early in our HTTP middleware.
@@ -306,7 +306,9 @@ where
// Create a router and specify the the handlers.
Router::builder()
.data(server)
- .middleware(Middleware::pre(|req| async move {
+ .middleware(Middleware::pre(|mut req| async move {
+ // we don't need the authorization header and we don't want to accidentally log it.
+ req.headers_mut().remove("authorization");
debug!(request = ?req,"Processing request");
Ok(req)
}))
