Response value shouldn't include request headers #222

Activity

1. gaborcsardi commented on Apr 23, 2025

   

   gaborcsardi

   on Apr 23, 2025

   Member

   More actions

   Yeah, that's a good argument for omitting the headers. OTOH the headers and the API key are nice when you want to get the next page, and the current implementation works even if your session was saved and later reloaded, e.g. like it happens on Posit Cloud.

   So this is a breaking change for some workflows.

   The security concerns probably trump the other issues though, so yes, we can remove the headers from the response.
2. gaborcsardi

   added

   bugan unexpected problem or unintended behavioran unexpected problem or unintended behavior

   on Apr 23, 2025
3. jennybc commented on Apr 23, 2025

   

   jennybc

   on Apr 23, 2025

   Member

   More actions

   Related: In gargle, I have a redact_response() helper:

   https://github.com/r-lib/gargle/blob/ef00eb0581a8eda05185a3a6348f80cff522dd76/R/response_process.R#L213-L218

   Whenever I process a response, I (probably) call redact_response() on it:

   https://github.com/r-lib/gargle/blob/ef00eb0581a8eda05185a3a6348f80cff522dd76/R/response_process.R#L79

   https://github.com/r-lib/gargle/blob/ef00eb0581a8eda05185a3a6348f80cff522dd76/R/response_process.R#L135

   I rigged this once I started saving the last response by default, for various post mortem investigations. I think it's nice to have some control over it.
4. gaborcsardi

   closed this as completedin b575d48on May 26, 2025