git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[RFC PATCH 0/2] Cookie redaction during GIT_TRACE_CURL

From
JTJonathan Tan <jonathantanmy@google.com>
Date
Jan 18, 2018, 00:34 UTC
Message-ID
<cover.1516235197.git.jonathantanmy@google.com>

Sometimes authentication information is sent over HTTP through cookies, but when using GIT_TRACE_CURL, that information appears in logs. There are some HTTP headers already redacted ("Authorization:" and "Proxy-Authorization:") - the first patch extends such redaction to a user-specified list.

I've also included another patch to allow omission of data transmission information from being logged when using GIT_TRACE_CURL. This reduces the information logged to that similar to GIT_CURL_VERBOSE. (As for why not use GIT_CURL_VERBOSE instead - that is because GIT_CURL_VERBOSE does not perform any redaction, merely using Curl's default logging mechanism.)

The patches are ready for merging, but I marked this as "RFC" just in case there is a better way to accomplish this.

Jonathan Tan (2):
  http: support cookie redaction when tracing
  http: support omitting data from traces
 http.c                      | 82 ++++++++++++++++++++++++++++++++++++++++-----
 t/t5551-http-fetch-smart.sh | 24 +++++++++++++
 2 files changed, 98 insertions(+), 8 deletions(-)
-- 
2.16.0.rc1.238.g530d649a79-goog
Next: Jonathan Tan
Message 1 of 5 in “Cookie redaction during GIT_TRACE_CURL”
  1. 0/2 Cookie redaction during GIT_TRACE_CURLJonathan Tan, Jan 18, 2018
  2. 2/2 http: support omitting data from tracesJonathan Tan, Jan 18, 2018
  3. Eric SunshineJan 18, 2018
  4. 1/2 http: support cookie redaction when tracingJonathan Tan, Jan 18, 2018
  5. Eric SunshineJan 18, 2018

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.