[fix] Obfuscate authorization header in debug mode

This has caused many problems, including @dscape being naked and users accidentally leaking their password.
nodejitsu · Nov 14, 2012 · 2f7fc03 · 2f7fc03
1 parent 4293e19
commit 2f7fc03
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/lib/jitsu.js b/lib/jitsu.js
@@ -248,6 +248,11 @@ jitsu.setup = function (callback) {
     jitsu[k].on('debug::response', debug);
     function debug (data) {
       if (jitsu.argv.debug || jitsu.config.get('debug')) {
+        if (data.headers && data.headers['Authorization']) {
+          data = JSON.parse(JSON.stringify(data));
+          data.headers['Authorization'] = Array(data.headers['Authorization'].length).join('*');
+        }
+
         util.inspect(data, false, null, true).split('\n').forEach(jitsu.log.debug);
       }
     };