From d39fbfac0192fc9a2dc825dc17ede29776863f5f Mon Sep 17 00:00:00 2001 From: Jordan Cook Date: Sun, 10 Apr 2022 12:15:46 -0500 Subject: Add default list of ignored_parameters for most common authentication params/headers --- docs/user_guide/security.md | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'docs') diff --git a/docs/user_guide/security.md b/docs/user_guide/security.md index cad4d3f..17cf380 100644 --- a/docs/user_guide/security.md +++ b/docs/user_guide/security.md @@ -69,3 +69,10 @@ BadSignature: Signature b'iFNmzdUOSw5vqrR9Cb_wfI1EoZ8' does not match ## Removing Sensitive Info The {ref}`ignored_parameters ` option can be used to prevent credentials and other sensitive info from being saved to the cache. It applies to request parameters, body, and headers. + +Some are ignored by default, including: +* `Authorization` header (most authentication systems) +* `access_token` request param (used by OAuth) +* `access_token` in POST body (used by OAuth) +* `X-API-KEY` header (used by OpenAPI spec) +* `api_key` request param (used by OpenAPI spec) -- cgit v1.2.1