biscuit-rust
biscuit-rust copied to clipboard
Consider removing Debug trait on Biscuit
Debug & Display Trait are very verbose by default.
This can easily lead to leaks of biscuit content in logs, for example if a biscuit is passed to an instrumented function with the tracing crate.
For example:
#[tracing::instrument]
pub fn handler(biscuit: Biscuit) { ... }
will include the biscuit debug output in the traces & logs.
Note: This can be avoided by ignoring the biscuit using #[tracing::instrument(skip(biscuit))], but this is quite fragile (easy to forget the skip option).
Note: Display impl was introduced by #117