What
Header dumps mask api-key alongside authorization, x-api-key, cookie and set-cookie, so an API key passed in that header no longer appears in logs.
Details
- The socket messaging mismatch warning also passes the message type and session id through a sanitizer before logging.
Evidence
t.toLowerCase() === "api-key"
Strings lifted out of the shipped bundle, so the claim above can be checked against them.