Provide a way to exclude headers from logs

README.md

@@ -765,6 +765,8 @@ public class Example {
 
 The SLF4JLogger (see above) may also be of interest.
 
+To filter out sensitive information like authorization or tokens
+override methods `shouldLogRequestHeader` or `shouldLogResponseHeader`.
 
 #### Request Interceptors
 When you need to change all requests, regardless of their target, you'll want to configure a `RequestInterceptor`.

core/src/main/java/feign/Logger.java

@@ -1,5 +1,5 @@
 /**
- * Copyright 2012-2020 The Feign Authors
+ * Copyright 2012-2021 The Feign Authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
  * in compliance with the License. You may obtain a copy of the License at
@@ -27,8 +27,7 @@
 public abstract class Logger {
 
   protected static String methodTag(String configKey) {
-    return new StringBuilder().append('[').append(configKey.substring(0, configKey.indexOf('(')))
-        .append("] ").toString();
+    return '[' + configKey.substring(0, configKey.indexOf('(')) + "] ";
   }
 
   /**
@@ -41,13 +40,35 @@ protected static String methodTag(String configKey) {
    */
   protected abstract void log(String configKey, String format, Object... args);
 
+  /**
+   * Override to filter out request headers.
+   *
+   * @param header header name
+   * @return true to log a request header
+   */
+  protected boolean shouldLogRequestHeader(String header) {
+    return true;
+  }
+
+  /**
+   * Override to filter out response headers.
+   *
+   * @param header header name
+   * @return true to log a response header
+   */
+  protected boolean shouldLogResponseHeader(String header) {
+    return true;
+  }
+
   protected void logRequest(String configKey, Level logLevel, Request request) {
     log(configKey, "---> %s %s HTTP/1.1", request.httpMethod().name(), request.url());
     if (logLevel.ordinal() >= Level.HEADERS.ordinal()) {
 
       for (String field : request.headers().keySet()) {
-        for (String value : valuesOrEmpty(request.headers(), field)) {
-          log(configKey, "%s: %s", field, value);
+        if (shouldLogRequestHeader(field)) {
+          for (String value : valuesOrEmpty(request.headers(), field)) {
+            log(configKey, "%s: %s", field, value);
+          }
         }
       }
 
@@ -84,8 +105,10 @@ protected Response logAndRebufferResponse(String configKey,
     if (logLevel.ordinal() >= Level.HEADERS.ordinal()) {
 
       for (String field : response.headers().keySet()) {
-        for (String value : valuesOrEmpty(response.headers(), field)) {
-          log(configKey, "%s: %s", field, value);
+        if (shouldLogResponseHeader(field)) {
+          for (String value : valuesOrEmpty(response.headers(), field)) {
+            log(configKey, "%s: %s", field, value);
+          }
         }
       }
 

core/src/test/java/feign/LoggerTest.java

@@ -1,5 +1,5 @@
 /**
- * Copyright 2012-2020 The Feign Authors
+ * Copyright 2012-2021 The Feign Authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
  * in compliance with the License. You may obtain a copy of the License at
@@ -49,7 +49,7 @@ public class LoggerTest {
   interface SendsStuff {
 
     @RequestLine("POST /")
-    @Headers("Content-Type: application/json")
+    @Headers({"Content-Type: application/json", "X-Token: qwerty"})
     @Body("%7B\"customer_name\": \"{customer_name}\", \"user_name\": \"{user_name}\", \"password\": \"{password}\"%7D")
     String login(
                  @Param("customer_name") String customer,
@@ -99,7 +99,7 @@ public static Iterable<Object[]> data() {
 
     @Test
     public void levelEmits() {
-      server.enqueue(new MockResponse().setBody("foo"));
+      server.enqueue(new MockResponse().setHeader("Y-Powered-By", "Mock").setBody("foo"));
 
       SendsStuff api = Feign.builder()
           .logger(logger)
@@ -383,9 +383,22 @@ public Retryer clone() {
 
   private static final class RecordingLogger extends Logger implements TestRule {
 
+    private static final String PREFIX_X = "x-";
+    private static final String PREFIX_Y = "y-";
+
     private final List<String> messages = new ArrayList<>();
     private final List<String> expectedMessages = new ArrayList<>();
 
+    @Override
+    protected boolean shouldLogRequestHeader(String header) {
+      return !header.toLowerCase().startsWith(PREFIX_X);
+    }
+
+    @Override
+    protected boolean shouldLogResponseHeader(String header) {
+      return !header.toLowerCase().startsWith(PREFIX_Y);
+    }
+
     void expectMessages(List<String> expectedMessages) {
       this.expectedMessages.addAll(expectedMessages);
     }

core/src/test/java/feign/MultipleLoggerTest.java

@@ -1,5 +1,5 @@
 /**
- * Copyright 2012-2020 The Feign Authors
+ * Copyright 2012-2021 The Feign Authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
  * in compliance with the License. You may obtain a copy of the License at
@@ -41,7 +41,7 @@ public void testAppendSeveralFilesToOneJavaLogger() throws Exception {
   }
 
   @Test
-  public void testJavaLoggerInstantationWithLoggerName() throws Exception {
+  public void testJavaLoggerInstantiationWithLoggerName() throws Exception {
     Logger.JavaLogger l1 = new Logger.JavaLogger("First client")
         .appendToFile(tmp.newFile("1.log").getAbsolutePath());
     Logger.JavaLogger l2 = new Logger.JavaLogger("Second client")

slf4j/src/main/java/feign/slf4j/Slf4jLogger.java

@@ -1,5 +1,5 @@
 /**
- * Copyright 2012-2020 The Feign Authors
+ * Copyright 2012-2021 The Feign Authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
  * in compliance with the License. You may obtain a copy of the License at