isSensitiveName reports whether a name (header or query parameter) looks like a credential-carrying key. Exact-match headers are checked first, then the rate-limit allowlist, then substring patterns for API keys and auth tokens.
(name string)
| 207 | // checked first, then the rate-limit allowlist, then substring |
| 208 | // patterns for API keys and auth tokens. |
| 209 | func isSensitiveName(name string) bool { |
| 210 | lowerName := strings.ToLower(name) |
| 211 | if _, ok := sensitiveHeaderNames[lowerName]; ok { |
| 212 | return true |
| 213 | } |
| 214 | if _, ok := safeRateLimitHeaderNames[lowerName]; ok { |
| 215 | return false |
| 216 | } |
| 217 | if strings.Contains(lowerName, "api-key") || |
| 218 | strings.Contains(lowerName, "api_key") || |
| 219 | strings.Contains(lowerName, "apikey") { |
| 220 | return true |
| 221 | } |
| 222 | // Catch any header containing "token" (e.g. Token, X-Token, |
| 223 | // X-Auth-Token). Safe rate-limit headers like |
| 224 | // x-ratelimit-remaining-tokens are already allowlisted above |
| 225 | // and will not reach this point. |
| 226 | if strings.Contains(lowerName, "token") { |
| 227 | return true |
| 228 | } |
| 229 | return strings.Contains(lowerName, "secret") || |
| 230 | strings.Contains(lowerName, "bearer") |
| 231 | } |
| 232 | |
| 233 | func isSensitiveJSONKey(key string) bool { |
| 234 | lowerKey := strings.ToLower(key) |
no test coverage detected