Skip to content

feat(sdk): TSSDK-71 do not leak auth header in errors#149

Open
mk0x9 wants to merge 1 commit into
mainfrom
feat/TSSDK-71-do-not-leak-auth-header-in-errors
Open

feat(sdk): TSSDK-71 do not leak auth header in errors#149
mk0x9 wants to merge 1 commit into
mainfrom
feat/TSSDK-71-do-not-leak-auth-header-in-errors

Conversation

@mk0x9

@mk0x9 mk0x9 commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

handleRequestError in platform-sdk.ts attached the raw Axios error as originalError on thrown APIError/UnexpectedError instances. That error's config.headers carries the request's Authorization bearer token in plaintext, which leaks out through JSON.stringify/toJSON() or direct property access if a consumer logs or forwards the caught error to an error tracker.

  • added redactAuthorizationHeader in errors.ts, called at the top of handleRequestError before the status-code switch;
  • it overwrites config.headers.Authorization with a redacted placeholder when present;
  • covered with a unit test in platform-sdk.test.ts asserting the token is redacted on the thrown error's originalError.

@codecov

codecov Bot commented Jul 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Impacted file tree graph

@@           Coverage Diff           @@
##             main     #149   +/-   ##
=======================================
  Coverage   98.11%   98.12%           
=======================================
  Files          14       14           
  Lines        2285     2296   +11     
  Branches      294      296    +2     
=======================================
+ Hits         2242     2253   +11     
  Misses         41       41           
  Partials        2        2           
Flag Coverage Δ
unittests 98.12% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
packages/sdk/src/errors.ts 95.74% <100.00%> (+1.15%) ⬆️
packages/sdk/src/platform-sdk.ts 99.32% <100.00%> (+<0.01%) ⬆️

Impacted file tree graph

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mk0x9
mk0x9 requested a review from santi698 July 23, 2026 11:04
@mk0x9
mk0x9 force-pushed the feat/TSSDK-71-do-not-leak-auth-header-in-errors branch from aa74ed7 to 610d04c Compare July 24, 2026 07:56
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants