TL;DR

Extend the HEADER_BLOCKLIST in GenericFunctions.ts to include common custom authentication header patterns to prevent credential exposure in execution logs.

Guidance

• Review the current HEADER_BLOCKLIST in GenericFunctions.ts to understand the existing redaction rules.
• Identify common custom authentication header patterns used in your application, such as X-Custom-Auth and X-Secret-Token, and add them to the HEADER_BLOCKLIST.
• Consider implementing a more flexible mechanism to detect and redact credential-like headers, rather than relying on a hardcoded list.
• Verify the changes by testing the execution logs with various custom authentication headers to ensure they are properly redacted.

Example

// Example of extended HEADER_BLOCKLIST
const HEADER_BLOCKLIST = [
  'authorization',
  'x-api-key',
  'x-auth-token',
  'cookie',
  'proxy-authorization',
  'sslclientcert',
  'x-custom-auth',
  'x-secret-token',
];

Notes

The recommended fix is pending, and the exact implementation details may vary depending on the specific requirements of your application. It's essential to carefully review and test any changes to ensure they do not introduce unintended consequences.

Recommendation

Apply a workaround by extending the HEADER_BLOCKLIST to include common custom authentication header patterns, as a temporary solution until a more comprehensive fix is available. This will help mitigate the risk of credential exposure in execution logs.