[HTTPCLIENT-2138] Debug Log level logs sensitive information

• Type: Wish
• Status: Resolved
• Priority: Minor
• Resolution: Not A Problem
• Component/s: HttpClient (classic)
• Assignee: Unassigned
• Reporter: Cyrus Vafadari
• Created: 17/Feb/21 19:17
• Updated: 16/Mar/21 08:30
• Resolved: 16/Mar/21 08:30

Description

When I enable debug level logging, I see

```

[2021-01-20 18:02:35,862] DEBUG http-outgoing-0 >> Authorization: Basic <CREDENTIALS_APPEAR_HEAR_IN_BASE64> (org.apache.http.headers:139) [2021-01-20 18:02:35,884] DEBUG http-outgoing-0 >> "Authorization: Basic <CREDENTIALS_APPEAR_HEAR_IN_BASE64>[\r][\n]" (org.apache.http.wire:54) [2021-01-20 18:02:35,899] DEBUG http-outgoing-0 << " <title>Unauthorized (401)</title>[\n]" (org.apache.http.wire:54)

```

If agreed, I can open a PR to mask secrets in the debug log. If that makes the log less useful, I can at least make this configurable, since in my case it is a security violation to have any secrets whatsover in the logs