{"version":"2.1.246","anchor":"sensitive-header-names-collected-in-the-http-client","canonical_anchor":"sensitive-header-names-collected-in-the-http-client","heading":"Sensitive header names collected in the HTTP client","tier":"internal","area":"Internals","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246\/e\/sensitive-header-names-collected-in-the-http-client","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246","markdown":"### Sensitive header names collected in the HTTP client\n\nThe HTTP layer now knows which header names count as secrets for masking.\n\n**What**\n\nThe first-party HTTP module gained a set of header names to treat as sensitive: `authorization`, `proxy-authorization`, `x-authorization`, `x-api-key` and `cookie`. It sits beside the trusted-origin list and the request wrappers, so it is part of the shared request path.\n\n**Evidence**\n\n`\"proxy-authorization\"`\n\n- Area: Internals\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}