securenow 8.12.0 → 8.12.1

package/header-redaction.js

@@ -0,0 +1,30 @@
+'use strict';
+
+// Request-header capture: credential-bearing headers are redacted by name. Fragments match
+// substring-wise on the lowercased header name, so `x-csrf-token`, `x-xsrf-token`,
+// `x-session-id` and `x-goog-api-key` are all caught. Configured `capture.sensitiveFields`
+// apply too, compared without case or punctuation (`csrfToken` matches `x-csrf-token`).
+
+const { OTP_SENSITIVE_FIELDS, matchesSensitiveField } = require('./otp-redaction');
+
+const SENSITIVE_HEADER_EXACT = new Set(['cookie', 'set-cookie', 'authorization', 'proxy-authorization']);
+const SENSITIVE_HEADER_FRAGMENTS = [
+  'token', 'secret', 'password', 'passwd', 'csrf', 'xsrf', 'session', 'api-key', 'apikey',
+  'api_key', 'credential', 'signature', 'private-key', 'x-auth',
+];
+
+const canonicalName = (s) => String(s).toLowerCase().replace(/[^a-z0-9]/g, '');
+
+function createHeaderNameRedactor(customSensitiveFields = []) {
+  const custom = customSensitiveFields.map(canonicalName).filter(Boolean);
+  return function isSensitiveHeaderName(name) {
+    const lower = String(name).toLowerCase();
+    if (SENSITIVE_HEADER_EXACT.has(lower)) return true;
+    if (SENSITIVE_HEADER_FRAGMENTS.some((f) => lower.includes(f))) return true;
+    if (matchesSensitiveField(lower, OTP_SENSITIVE_FIELDS)) return true;
+    const canon = canonicalName(lower);
+    return custom.some((f) => canon.includes(f));
+  };
+}
+
+module.exports = { createHeaderNameRedactor, SENSITIVE_HEADER_EXACT, SENSITIVE_HEADER_FRAGMENTS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.12.0",
+  "version": "8.12.1",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",
@@ -10,7 +10,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-internal-thread.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-internal-thread.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -161,6 +161,7 @@
     "internal-thread.js",
     "legacy-semconv.js",
     "otp-redaction.js",
+    "header-redaction.js",
     "rate-limits.js",
     "rate-limits.d.ts",
     "firewall-only.js",

package/tracing.js

@@ -433,6 +433,10 @@ const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveField
 
 const captureMultipart = appConfig.boolConfig('capture.multipart', true);
 
+// Credential-bearing request headers (cookies, auth, CSRF/XSRF, session, API keys, and any
+// configured capture.sensitiveFields) are redacted by name before capture.
+const isSensitiveHeaderName = require('./header-redaction').createHeaderNameRedactor(customSensitiveFields);
+
 const BODY_CAPTURE_PATCH = Symbol.for('securenow.bodyCapture.emitPatch');
 
 function installRequestBodyObserver(span, request, contentType) {
@@ -599,11 +603,10 @@ const httpInstrumentation = new HttpInstrumentation(withLegacyHttpSemconv({
       }
 
       if (request.headers) {
-        const SKIP_HEADERS = new Set(['cookie', 'authorization', 'proxy-authorization', 'set-cookie', 'x-api-key', 'x-auth-token']);
         const safe = {};
         for (const [k, v] of Object.entries(request.headers)) {
-          if (SKIP_HEADERS.has(k.toLowerCase()) || matchesSensitiveField(k, OTP_SENSITIVE_FIELDS)) { safe[k] = '[REDACTED]'; continue; }
-          safe[k] = redactOtpQuery(typeof v === 'string' ? v : String(v)).substring(0, 500);
+          if (isSensitiveHeaderName(k)) { safe[k] = '[REDACTED]'; continue; }
+          safe[k] = redactSensitiveValue(redactOtpQuery(typeof v === 'string' ? v : String(v))).substring(0, 500);
         }
         const serialized = JSON.stringify(safe);
         if (serialized.length <= 8192) {