Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish "Exclude cookie headers by default from HTTP traces"

Browse Source 
See gh-22829
This commit is contained in:
Andy Wilkinson
2020-08-11 15:35:23 +01:00
parent 5ff515727d
commit e358144b2e
2 changed files with 26 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/trace/http/HttpTraceProperties.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2019 the original author or authors.
* Copyright 2012-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -37,8 +37,7 @@ public class HttpTraceProperties {
/**
* Items to be included in the trace. Defaults to request headers (excluding
* Authorization but including Cookie), response headers (including Set-Cookie), and
* time taken.
* Authorization and Cookie), response headers (excluding Set-Cookie), and time taken.
*/
private Set<Include> include = new HashSet<>(Include.defaultIncludes());

24
spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/trace/http/HttpExchangeTracerTests.java
View File

@@ -29,6 +29,7 @@ import org.junit.jupiter.api.Test;
import org.springframework.boot.actuate.trace.http.HttpTrace.Request;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
@@ -270,6 +271,29 @@ class HttpExchangeTracerTests {
assertThat(trace.getTimeTaken()).isNotNull();
}
@Test
void defaultIncludes() {
HttpHeaders requestHeaders = new HttpHeaders();
requestHeaders.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));
requestHeaders.set(HttpHeaders.COOKIE, "value");
requestHeaders.set(HttpHeaders.AUTHORIZATION, "secret");
HttpExchangeTracer tracer = new HttpExchangeTracer(Include.defaultIncludes());
HttpTrace trace = tracer.receivedRequest(createRequest(requestHeaders));
HttpHeaders responseHeaders = new HttpHeaders();
responseHeaders.set(HttpHeaders.SET_COOKIE, "test=test");
responseHeaders.setContentLength(0);
tracer.sendingResponse(trace, createResponse(responseHeaders), this::createPrincipal, () -> "sessionId");
assertThat(trace.getTimeTaken()).isNotNull();
assertThat(trace.getPrincipal()).isNull();
assertThat(trace.getSession()).isNull();
assertThat(trace.getTimestamp()).isNotNull();
assertThat(trace.getRequest().getMethod()).isEqualTo("GET");
assertThat(trace.getRequest().getRemoteAddress()).isNull();
assertThat(trace.getResponse().getStatus()).isEqualTo(204);
assertThat(trace.getRequest().getHeaders()).containsOnlyKeys(HttpHeaders.ACCEPT);
assertThat(trace.getResponse().getHeaders()).containsOnlyKeys(HttpHeaders.CONTENT_LENGTH);
}
private TraceableRequest createRequest() {
return createRequest(Collections.singletonMap(HttpHeaders.ACCEPT, Arrays.asList("application/json")));
}