ghz icon indicating copy to clipboard operation
ghz copied to clipboard

security: provide a way to view reports with plain text authorization masked or removed

Open softprops opened this issue 1 year ago • 0 comments

Is your feature request related to a problem? Please describe.

while getting authorized requests to work with https://github.com/bojand/ghz/issues/424 I found that when I generated a report with --format=html the report showed in plaintext the authorization metadata. this is a secret credential that should never be viewed in plaintext. these reports are useful but make it easy to leak sensitive info sent in request metadata

Describe the solution you'd like

provide a configuration option to hide or omit metadata keys from generated reports. these reports should be sharable without also sharing private api credentials

Describe alternatives you've considered

sed report impl details to exclude authorization header

Additional context

softprops avatar Dec 16 '24 05:12 softprops