From 08e51b48be47e705be3e8ae445cdbdd46418870d Mon Sep 17 00:00:00 2001 From: barry3406 Date: Thu, 9 Apr 2026 06:10:47 -0700 Subject: [PATCH] fix: sanitize Proxy-Authorization header in recovery panic logs secureRequestDump only masks the Authorization header but not Proxy-Authorization, which also carries credentials (used by gin's own BasicAuthForProxy middleware). When a panic occurs behind proxy auth, credentials are logged in plaintext. --- recovery.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/recovery.go b/recovery.go index bbf1d565..802035a9 100644 --- a/recovery.go +++ b/recovery.go @@ -99,8 +99,8 @@ func secureRequestDump(r *http.Request) string { httpRequest, _ := httputil.DumpRequest(r, false) lines := strings.Split(bytesconv.BytesToString(httpRequest), "\r\n") for i, line := range lines { - if strings.HasPrefix(line, "Authorization:") { - lines[i] = "Authorization: *" + if strings.HasPrefix(line, "Authorization:") || strings.HasPrefix(line, "Proxy-Authorization:") { + lines[i] = strings.SplitN(line, ":", 2)[0] + ": *" } } return strings.Join(lines, "\r\n")