Censor authorization header value in logs

toot/logging.py

@@ -3,11 +3,21 @@ from logging import getLogger
 logger = getLogger('toot')
 
 
+def censor_secrets(headers):
+    def _censor(k, v):
+        if k == "Authorization":
+            return (k, "***CENSORED***")
+        return k, v
+
+    return {_censor(k, v) for k, v in headers.items()}
+
+
 def log_request(request):
     logger.debug(">>> \033[32m{} {}\033[0m".format(request.method, request.url))
 
     if request.headers:
-        logger.debug(">>> HEADERS: \033[33m{}\033[0m".format(request.headers))
+        headers = censor_secrets(request.headers)
+        logger.debug(">>> HEADERS: \033[33m{}\033[0m".format(headers))
 
     if request.data:
         logger.debug(">>> DATA:    \033[33m{}\033[0m".format(request.data))