[BUG] Authorization header included when enableRequestHeaderTracking is enabled

[mauve]

Description/Screenshot

View in application insights portal:

Steps to Reproduce

• OS/Browser: any
• SDK Version [e.g. 22]: 2.6.2
• How you initialized the SDK:

ai = new ApplicationInsights({
    config: {
      instrumentationKey: key,
      disableFetchTracking: false,
      enableCorsCorrelation: true,
      enableRequestHeaderTracking: true,
      enableResponseHeaderTracking: true
    }
  });

Enable request header tracing using enableRequestHeaderTracing. The Authorization/authorization header now gets logged and the token can be stolen by anybody looking at the logs.

Expected behavior

The Authorization/authorization header should not be logged, instead a redacted version should be logged, e.g. instead of Authorization: Bearer Asddsfsdafsdafdsafdsafdsaf it should say something like Authorization: {REDACTED}

Additional context

[MSNev]

1000% agree, I'm not sure how or why this has not been brought up before...

I'm sure that the Authorization header is not this only one to fall into this category, this (to me) sounds like we should add the ability to supply a config (which default to known headers) to define which headers to exclude or redact (as suggested) from this (and response header tracking)

I'll raise this with the team and we will try and get this into the next release.

[MSNev]

v2.6.3 is now fully deployed

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.