Added a setting to hide select response headers

README.md

@@ -646,9 +646,12 @@ headers  | Only the response headers(including _status line_) are previewed
 body     | Only the response body is previewed
 exchange | Preview the whole HTTP exchange(request and response)
 
+You may also suppress individual header output via the `rest-client.hiddenResponseHeaders` setting.
+
 ## Settings
 * `rest-client.followredirect`: Follow HTTP 3xx responses as redirects. (Default is __true__)
 * `rest-client.defaultHeaders`: If particular headers are omitted in request header, these will be added as headers for each request. (Default is `{ "User-Agent": "vscode-restclient", "Accept-Encoding": "gzip" }`)
+* `rest-client.hiddenResponseHeaders`: List of HTTP header names (e.g. `["x-content-security-policy"]`), output of which will be suppressed (useful for hiding sensitive/unrelated headers for demo purposes). The entries on the list are case-sensitive. (Default is __[]__)
 * `rest-client.timeoutinmilliseconds`: Timeout in milliseconds. 0 for infinity. (Default is __0__)
 * `rest-client.showResponseInDifferentTab`: Show response in different tab. (Default is __false__)
 * `rest-client.requestNameAsResponseTabTitle`: Show request name as the response tab title. Only valid when using html view, if no request name is specified defaults to "Response". (Default is __false__)

package.json

@@ -341,6 +341,18 @@
           "scope": "resource",
           "description": "If particular headers are omitted in request headers, these will be added as headers for each request."
         },
+        "rest-client.hiddenResponseHeaders": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "uniqueItems": true,
+            "pattern": "^[0-9a-zA-Z^_`|~!#$%&'*+-.]*$"
+          },
+          "default": [],
+          "scope": "resource",
+          "description": "List of HTTP header names, output of which will be suppressed (useful for hiding sensitive/unrelated headers for demo purposes). The entries on the list are case-sensitive."
+        },
         "rest-client.timeoutinmilliseconds": {
           "type": "integer",
           "default": 0,

src/models/configurationSettings.ts

@@ -18,6 +18,7 @@ export type HostCertificates = {
 interface IRestClientSettings {
     followRedirect: boolean;
     defaultHeaders: RequestHeaders;
+    hiddenResponseHeaders: string[];
     timeoutInMilliseconds: number;
     showResponseInDifferentTab: boolean;
     requestNameAsResponseTabTitle: boolean;
@@ -51,6 +52,7 @@ interface IRestClientSettings {
 export class RestClientSettings implements IRestClientSettings {
     public followRedirect: boolean;
     public defaultHeaders: RequestHeaders;
+    public hiddenResponseHeaders: string[];
     public timeoutInMilliseconds: number;
     public showResponseInDifferentTab: boolean;
     public requestNameAsResponseTabTitle: boolean;
@@ -122,6 +124,7 @@ export class RestClientSettings implements IRestClientSettings {
                                                                      {
                                                                          "User-Agent": "vscode-restclient"
                                                                      });
+        this.hiddenResponseHeaders = restClientSettings.get<string[]>("hiddenResponseHeaders", []);
         this.showResponseInDifferentTab = restClientSettings.get<boolean>("showResponseInDifferentTab", false);
         this.requestNameAsResponseTabTitle = restClientSettings.get<boolean>("requestNameAsResponseTabTitle", false);
         this.rememberCookiesForSubsequentRequests = restClientSettings.get<boolean>("rememberCookiesForSubsequentRequests", true);

src/views/httpResponseTextDocumentView.ts

@@ -75,9 +75,12 @@ export class HttpResponseTextDocumentView {
 
     private formatHeaders(headers: RequestHeaders | ResponseHeaders): string {
         let headerString = '';
+        const suppressedHeaders = this.settings.hiddenResponseHeaders;
         for (const header in headers) {
-            const value = headers[header] as string;
-            headerString += `${header}: ${value}${EOL}`;
+            if (suppressedHeaders.indexOf(header) === -1) {
+                const value = headers[header] as string;
+                headerString += `${header}: ${value}${EOL}`;
+            }
         }
         return headerString;
     }

src/views/httpResponseWebview.ts

@@ -233,7 +233,7 @@ export class HttpResponseWebview extends BaseWebview {
             // for add request details
             const request = response.request;
             const requestNonBodyPart = `${request.method} ${request.url} HTTP/1.1
-${HttpResponseWebview.formatHeaders(request.headers)}`;
+${HttpResponseWebview.formatHeaders(request.headers, this.settings.hiddenResponseHeaders)}`;
             code += hljs.highlight('http', requestNonBodyPart + '\r\n').value;
             if (request.body) {
                 if (typeof request.body !== 'string') {
@@ -254,7 +254,7 @@ ${HttpResponseWebview.formatHeaders(request.headers)}`;
 
         if (previewOption !== PreviewOption.Body) {
             const responseNonBodyPart = `HTTP/${response.httpVersion} ${response.statusCode} ${response.statusMessage}
-${HttpResponseWebview.formatHeaders(response.headers)}`;
+${HttpResponseWebview.formatHeaders(response.headers, this.settings.hiddenResponseHeaders)}`;
             code += hljs.highlight('http', responseNonBodyPart + (previewOption !== PreviewOption.Headers ? '\r\n' : '')).value;
         }
 
@@ -397,10 +397,10 @@ ${HttpResponseWebview.formatHeaders(response.headers)}`;
         return result;
     }
 
-    private static formatHeaders(headers: RequestHeaders | ResponseHeaders): string {
+    private static formatHeaders(headers: RequestHeaders | ResponseHeaders, suppressedHeaders: string[]): string {
         let headerString = '';
         for (const header in headers) {
-            if (headers.hasOwnProperty(header)) {
+            if (suppressedHeaders.indexOf(header) === -1 && headers.hasOwnProperty(header)) {
                 let value = headers[header];
                 if (typeof headers[header] !== 'string') {
                     value = <string>headers[header];