@workleap/logrocket 4.0.5 → 4.0.6

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @workleap/logrocket
 
+## 4.0.6
+
+### Patch Changes
+
+- [#275](https://github.com/workleap/wl-telemetry/pull/275) [`0128608`](https://github.com/workleap/wl-telemetry/commit/012860830e4e4a17dc6960c9e3d310e7aac98b8e) Thanks [@patricklafrance](https://github.com/patricklafrance)! - Redact the credential headers of the network requests and responses recorded in LogRocket session replays, regardless of the casing of the header name. A header is now redacted when its name contains `auth`, `cookie`, `token`, `session`, `secret`, `key`, `csrf`, `xsrf` or `x-honeycomb-team`. Previously, only a request header named exactly `Authorization` was redacted.
+
 ## 4.0.5
 
 ### Patch Changes

package/dist/js/createRequestSanitizer.js

@@ -1,8 +1,10 @@
+import { sanitizeHeaders } from "./sanitizeHeaders.js";
+
+
+
 function createRequestSanitizer(fuzzyRequestSanitizer) {
     return (req)=>{
-        if (req.headers["Authorization"]) {
-            req.headers["Authorization"] = "**redacted**";
-        }
+        req.headers = sanitizeHeaders(req.headers);
         if (req.body) {
             // Do not return the request body, which could contain sensitive information.
             req.body = "**redacted**";

package/dist/js/createRequestSanitizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"js/createRequestSanitizer.js","sources":["../../src/js/createRequestSanitizer.ts"],"sourcesContent":["import type { LogRocketRequest } from \"./logRocketTypes.ts\";\n\n// oxlint-disable-next-line typescript/no-explicit-any\nexport type RequestSanitizerFunction = (req: LogRocketRequest) => any;\n\nexport function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction) {\n    return (req: LogRocketRequest) => {\n        if (req.headers[\"Authorization\"]) {\n            req.headers[\"Authorization\"] = \"**redacted**\";\n        }\n\n        if (req.body) {\n            // Do not return the request body, which could contain sensitive information.\n            req.body = \"**redacted**\";\n        }\n\n        return fuzzyRequestSanitizer(req);\n    };\n}\n"],"names":["createRequestSanitizer","fuzzyRequestSanitizer","req"],"mappings":"AAKO,SAASA,uBAAuBC,qBAA+C;IAClF,OAAO,CAACC;QACJ,IAAIA,IAAI,OAAO,CAAC,gBAAgB,EAAE;YAC9BA,IAAI,OAAO,CAAC,gBAAgB,GAAG;QACnC;QAEA,IAAIA,IAAI,IAAI,EAAE;YACV,6EAA6E;YAC7EA,IAAI,IAAI,GAAG;QACf;QAEA,OAAOD,sBAAsBC;IACjC;AACJ"}
+{"version":3,"file":"js/createRequestSanitizer.js","sources":["../../src/js/createRequestSanitizer.ts"],"sourcesContent":["import type { LogRocketRequest } from \"./logRocketTypes.ts\";\nimport { sanitizeHeaders } from \"./sanitizeHeaders.ts\";\n\n// oxlint-disable-next-line typescript/no-explicit-any\nexport type RequestSanitizerFunction = (req: LogRocketRequest) => any;\n\nexport function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction) {\n    return (req: LogRocketRequest) => {\n        req.headers = sanitizeHeaders(req.headers);\n\n        if (req.body) {\n            // Do not return the request body, which could contain sensitive information.\n            req.body = \"**redacted**\";\n        }\n\n        return fuzzyRequestSanitizer(req);\n    };\n}\n"],"names":["sanitizeHeaders","createRequestSanitizer","fuzzyRequestSanitizer","req"],"mappings":";;;AACuD;AAKhD,SAASC,uBAAuBC,qBAA+C;IAClF,OAAO,CAACC;QACJA,IAAI,OAAO,GAAGH,eAAeA,CAACG,IAAI,OAAO;QAEzC,IAAIA,IAAI,IAAI,EAAE;YACV,6EAA6E;YAC7EA,IAAI,IAAI,GAAG;QACf;QAEA,OAAOD,sBAAsBC;IACjC;AACJ"}

package/dist/js/createResponseSanitizer.js

@@ -1,5 +1,10 @@
+import { sanitizeHeaders } from "./sanitizeHeaders.js";
+
+
+
 function createResponseSanitizer(fuzzyResponseSanitizer) {
     return (res)=>{
+        res.headers = sanitizeHeaders(res.headers);
         if (res.body) {
             // Do not return the response body, which could contain sensitive information.
             res.body = "**redacted**";

package/dist/js/createResponseSanitizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"js/createResponseSanitizer.js","sources":["../../src/js/createResponseSanitizer.ts"],"sourcesContent":["import type { LogRocketResponse } from \"./logRocketTypes.ts\";\n\n// oxlint-disable-next-line typescript/no-explicit-any\nexport type ResponseSanitizerFunction = (res: LogRocketResponse) => any;\n\nexport function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction) {\n    return (res: LogRocketResponse) => {\n        if (res.body) {\n            // Do not return the response body, which could contain sensitive information.\n            res.body = \"**redacted**\";\n        }\n\n        return fuzzyResponseSanitizer(res);\n    };\n}\n"],"names":["createResponseSanitizer","fuzzyResponseSanitizer","res"],"mappings":"AAKO,SAASA,wBAAwBC,sBAAiD;IACrF,OAAO,CAACC;QACJ,IAAIA,IAAI,IAAI,EAAE;YACV,8EAA8E;YAC9EA,IAAI,IAAI,GAAG;QACf;QAEA,OAAOD,uBAAuBC;IAClC;AACJ"}
+{"version":3,"file":"js/createResponseSanitizer.js","sources":["../../src/js/createResponseSanitizer.ts"],"sourcesContent":["import type { LogRocketResponse } from \"./logRocketTypes.ts\";\nimport { sanitizeHeaders } from \"./sanitizeHeaders.ts\";\n\n// oxlint-disable-next-line typescript/no-explicit-any\nexport type ResponseSanitizerFunction = (res: LogRocketResponse) => any;\n\nexport function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction) {\n    return (res: LogRocketResponse) => {\n        res.headers = sanitizeHeaders(res.headers);\n\n        if (res.body) {\n            // Do not return the response body, which could contain sensitive information.\n            res.body = \"**redacted**\";\n        }\n\n        return fuzzyResponseSanitizer(res);\n    };\n}\n"],"names":["sanitizeHeaders","createResponseSanitizer","fuzzyResponseSanitizer","res"],"mappings":";;;AACuD;AAKhD,SAASC,wBAAwBC,sBAAiD;IACrF,OAAO,CAACC;QACJA,IAAI,OAAO,GAAGH,eAAeA,CAACG,IAAI,OAAO;QAEzC,IAAIA,IAAI,IAAI,EAAE;YACV,8EAA8E;YAC9EA,IAAI,IAAI,GAAG;QACf;QAEA,OAAOD,uBAAuBC;IAClC;AACJ"}

package/dist/js/sanitizeHeaders.d.ts

@@ -0,0 +1,3 @@
+export declare function sanitizeHeaders(headers: unknown): {
+    [key: string]: string | null | undefined;
+};

package/dist/js/sanitizeHeaders.js

@@ -0,0 +1,32 @@
+// A header is redacted when its lowercased name contains one of the following values.
+const PrivateHeaderNames = [
+    "auth",
+    "cookie",
+    "token",
+    "session",
+    "secret",
+    "key",
+    "csrf",
+    "xsrf",
+    "x-honeycomb-team"
+];
+// When the headers of a fetch request are provided as an array of tuples, LogRocket indexes the headers by their position
+// and the header name ends up in the value, e.g. { "0": "Authorization,Bearer 123" }.
+const IndexedHeaderNameRegEx = /^\d+$/;
+function isPrivateHeader(name) {
+    const lowercasedName = name.toLowerCase();
+    return IndexedHeaderNameRegEx.test(name) || PrivateHeaderNames.some((x)=>lowercasedName.includes(x));
+}
+function sanitizeHeaders(headers) {
+    const sanitizedHeaders = {};
+    if (headers !== null && typeof headers === "object") {
+        for (const [name, value] of Object.entries(headers)){
+            sanitizedHeaders[name] = isPrivateHeader(name) ? "**redacted**" : value;
+        }
+    }
+    return sanitizedHeaders;
+}
+
+export { sanitizeHeaders };
+
+//# sourceMappingURL=sanitizeHeaders.js.map

package/dist/js/sanitizeHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"js/sanitizeHeaders.js","sources":["../../src/js/sanitizeHeaders.ts"],"sourcesContent":["import type { LogRocketRequest } from \"./logRocketTypes.ts\";\n\n// A header is redacted when its lowercased name contains one of the following values.\nconst PrivateHeaderNames = [\"auth\", \"cookie\", \"token\", \"session\", \"secret\", \"key\", \"csrf\", \"xsrf\", \"x-honeycomb-team\"];\n\n// When the headers of a fetch request are provided as an array of tuples, LogRocket indexes the headers by their position\n// and the header name ends up in the value, e.g. { \"0\": \"Authorization,Bearer 123\" }.\nconst IndexedHeaderNameRegEx = /^\\d+$/;\n\nfunction isPrivateHeader(name: string) {\n    const lowercasedName = name.toLowerCase();\n\n    return IndexedHeaderNameRegEx.test(name) || PrivateHeaderNames.some(x => lowercasedName.includes(x));\n}\n\nexport function sanitizeHeaders(headers: unknown) {\n    const sanitizedHeaders: LogRocketRequest[\"headers\"] = {};\n\n    if (headers !== null && typeof headers === \"object\") {\n        for (const [name, value] of Object.entries(headers)) {\n            sanitizedHeaders[name] = isPrivateHeader(name) ? \"**redacted**\" : value;\n        }\n    }\n\n    return sanitizedHeaders;\n}\n"],"names":["PrivateHeaderNames","IndexedHeaderNameRegEx","isPrivateHeader","name","lowercasedName","x","sanitizeHeaders","headers","sanitizedHeaders","value","Object"],"mappings":"AAEA,sFAAsF;AACtF,MAAMA,qBAAqB;IAAC;IAAQ;IAAU;IAAS;IAAW;IAAU;IAAO;IAAQ;IAAQ;CAAmB;AAEtH,0HAA0H;AAC1H,sFAAsF;AACtF,MAAMC,yBAAyB;AAE/B,SAASC,gBAAgBC,IAAY;IACjC,MAAMC,iBAAiBD,KAAK,WAAW;IAEvC,OAAOF,uBAAuB,IAAI,CAACE,SAASH,mBAAmB,IAAI,CAACK,CAAAA,IAAKD,eAAe,QAAQ,CAACC;AACrG;AAEO,SAASC,gBAAgBC,OAAgB;IAC5C,MAAMC,mBAAgD,CAAC;IAEvD,IAAID,YAAY,QAAQ,OAAOA,YAAY,UAAU;QACjD,KAAK,MAAM,CAACJ,MAAMM,MAAM,IAAIC,OAAO,OAAO,CAACH,SAAU;YACjDC,gBAAgB,CAACL,KAAK,GAAGD,gBAAgBC,QAAQ,iBAAiBM;QACtE;IACJ;IAEA,OAAOD;AACX"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workleap/logrocket",
-  "version": "4.0.5",
+  "version": "4.0.6",
   "description": "A package containing utilities for LogRocket.",
   "license": "Apache-2.0",
   "author": "Workleap",
@@ -30,8 +30,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "provenance": true,
-    "registry": "https://registry.npmjs.org/"
+    "provenance": true
   },
   "dependencies": {
     "@workleap-telemetry/core": "^2.0.7",

package/src/js/createRequestSanitizer.ts

@@ -1,13 +1,12 @@
 import type { LogRocketRequest } from "./logRocketTypes.ts";
+import { sanitizeHeaders } from "./sanitizeHeaders.ts";
 
 // oxlint-disable-next-line typescript/no-explicit-any
 export type RequestSanitizerFunction = (req: LogRocketRequest) => any;
 
 export function createRequestSanitizer(fuzzyRequestSanitizer: RequestSanitizerFunction) {
     return (req: LogRocketRequest) => {
-        if (req.headers["Authorization"]) {
-            req.headers["Authorization"] = "**redacted**";
-        }
+        req.headers = sanitizeHeaders(req.headers);
 
         if (req.body) {
             // Do not return the request body, which could contain sensitive information.

package/src/js/createResponseSanitizer.ts

@@ -1,10 +1,13 @@
 import type { LogRocketResponse } from "./logRocketTypes.ts";
+import { sanitizeHeaders } from "./sanitizeHeaders.ts";
 
 // oxlint-disable-next-line typescript/no-explicit-any
 export type ResponseSanitizerFunction = (res: LogRocketResponse) => any;
 
 export function createResponseSanitizer(fuzzyResponseSanitizer: ResponseSanitizerFunction) {
     return (res: LogRocketResponse) => {
+        res.headers = sanitizeHeaders(res.headers);
+
         if (res.body) {
             // Do not return the response body, which could contain sensitive information.
             res.body = "**redacted**";

package/src/js/sanitizeHeaders.ts

@@ -0,0 +1,26 @@
+import type { LogRocketRequest } from "./logRocketTypes.ts";
+
+// A header is redacted when its lowercased name contains one of the following values.
+const PrivateHeaderNames = ["auth", "cookie", "token", "session", "secret", "key", "csrf", "xsrf", "x-honeycomb-team"];
+
+// When the headers of a fetch request are provided as an array of tuples, LogRocket indexes the headers by their position
+// and the header name ends up in the value, e.g. { "0": "Authorization,Bearer 123" }.
+const IndexedHeaderNameRegEx = /^\d+$/;
+
+function isPrivateHeader(name: string) {
+    const lowercasedName = name.toLowerCase();
+
+    return IndexedHeaderNameRegEx.test(name) || PrivateHeaderNames.some(x => lowercasedName.includes(x));
+}
+
+export function sanitizeHeaders(headers: unknown) {
+    const sanitizedHeaders: LogRocketRequest["headers"] = {};
+
+    if (headers !== null && typeof headers === "object") {
+        for (const [name, value] of Object.entries(headers)) {
+            sanitizedHeaders[name] = isPrivateHeader(name) ? "**redacted**" : value;
+        }
+    }
+
+    return sanitizedHeaders;
+}