Skip to content

💡cloudflared tunnel - do not log sensitive headers #1372

Open
@eherde

Description

@eherde

Describe the feature you'd like

When run with log level debug, cloudflared logs a line like the below, including all headers.

2024-12-16T15:04:35Z DBG GET <url> HTTP/1.1 connIndex=1 content-length=0 event=1 headers=<headers> host=<host> ingressRule=0 originService=http://<origin>:<port> path=<path>

The Authorization header is particularly sensitive and not one we want appearing in our logs. I'd like to be able to set logging to debug in production without concern for a potential security risk.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Priority: NormalMinor issue impacting one or more usersType: Feature RequestA big idea that would be split into smaller pieces

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions