@jaypie/express 1.2.14 → 1.2.15

package/dist/cjs/summarizeRequest.helper.d.ts

@@ -2,7 +2,7 @@ import type { Request } from "express";
 export interface RequestSummary {
     baseUrl: string;
     body: unknown;
-    headers: Request["headers"];
+    headers: Record<string, string | string[] | undefined>;
     method: string;
     query: Request["query"];
     url: string;

package/dist/esm/index.js

@@ -4,7 +4,7 @@ import { CorsError, BadRequestError, UnhandledError, GatewayTimeoutError, Unavai
 import { force, envBoolean, JAYPIE, HTTP, getHeaderFrom, jaypieHandler } from '@jaypie/kit';
 import expressCors from 'cors';
 import { loadEnvSecrets, getContentTypeForFormat, formatStreamError } from '@jaypie/aws';
-import { log } from '@jaypie/logger';
+import { log, redactAuth } from '@jaypie/logger';
 import { hasDatadogEnv, submitMetric, DATADOG } from '@jaypie/datadog';
 
 //
@@ -1510,6 +1510,11 @@ const decorateResponse = (res, { handler = "", version = process.env.PROJECT_VER
 // about the environment's secret parameters, the special adapter,
 // HTTP, etc.  There must be a better way to organize this
 
+//
+//
+// Constants
+//
+const SENSITIVE_HEADERS = new Set(["authorization", "cookie", "set-cookie"]);
 //
 //
 // Function Definition
@@ -1520,10 +1525,19 @@ function summarizeRequest(req) {
     if (Buffer.isBuffer(body)) {
         body = body.toString();
     }
+    // Redact sensitive headers
+    const headers = {
+        ...req.headers,
+    };
+    for (const key of Object.keys(headers)) {
+        if (SENSITIVE_HEADERS.has(key.toLowerCase())) {
+            headers[key] = redactAuth(headers[key]);
+        }
+    }
     return {
         baseUrl: req.baseUrl,
         body,
-        headers: req.headers,
+        headers,
         method: req.method,
         query: req.query,
         url: req.url,