v9.2.0

What's Changed

Keep secrets out of cassettes with filter_sensitive_data

my_vcr = vcr.VCR(filter_sensitive_data={"<API_KEY>": os.environ.get("API_KEY", "fake-api-key")})

Every occurrence of the value in a recorded interaction, in the URL, headers and request and response bodies, is replaced with the placeholder when the cassette is saved, and put back when it's loaded. So:

• the cassette file only contains <API_KEY>,
• requests made with the real value still match the recorded ones, and
• your code gets the same responses whether they're recorded or played back, including parts of responses that contained the secret.

Values can also be functions of the interaction. See the docs for using it in CI without the real secret, and for values that are encoded differently in different places. Modeled on Ruby VCR's option of the same name.

Save and load hooks

before_save_interaction and after_load_interaction get each interaction's request and response, plus the cassette if they take a third argument, when a cassette is saved and loaded. They return them, changed or not, or None to leave the interaction out. Unlike before_record_request and before_record_response, they run exactly once per interaction. Some uses, from issues:

• change a response based on its request, e.g. scrub a token only from a login response (#527, #556)
• keep cookies out of cassettes (#569)
• replay part of a cassette and record the rest again (#892)
• keep using old cassettes after an API or URL format changes

See the docs for examples. They're modeled on Ruby VCR's before_record and before_playback hooks, and filter_sensitive_data is built on them. Thanks to the authors of #679 and #594, which explored this.

Cassettes also have a new read-only path property.

Full Changelog: v9.1.0...v9.2.0