Repository navigation
feat: mask what leaves the machine with mnfst/http-redact - #50
Open
guillaumegay13 wants to merge 3 commits into
Open
guillaumegay13 wants to merge 3 commits into
guillaumegay13 wants to merge 3 commits into
Conversation
Credential values are replaced in place by REDACTED wherever they sit (query, path, headers, cookies, nested body fields, vendor keys and tokens in free text, the error response) instead of the SDK's own name lists, which withheld only top-level body keys and never looked at paths or values. - Masked is the one caller of the library: heal payload, retry error report, failure messages, onHeal URL. Tracked URLs mask their path at record time (~2.5 µs), before the spool file. - Replay restores before a retry: a value the heal left as sent takes the original back, a masked value it left out of an object is put back, a changed value stays. Lists, paths and repeated query names are restored only while their shape is unchanged, and a mask at any address the original does not hold refuses the retry. - Merge and the local secret lists are removed. Docs and wire fixtures updated. Refs #40, mnfst/app#191
guillaumegay13
marked this pull request as ready for review
September 27, 2026 05:33
Fixing an API call does not need them, and they carry sessions. The retry keeps the app's own headers, cookies included.
The masker now masks a response by shape only (mnfst/http-redact b18c4e0): "code": "invalid_value" was turning into REDACTED, hiding what a fix is found by.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the client-side part of #40 (secrets in outbound calls) and implements mnfst/app#191 §4 for PHP.
What changes
Credential values are now masked by mnfst/http-redact (threat model in its README), replaced in place by
REDACTED, before anything leaves the process:Bearer REDACTEDkeeps its schemecode/code_verifier/statesrc/Masked.phpis the only caller of the library.Retry restore (
Replay)REDACTED, or a string masked partway) takes the original back; a masked value it left out of an object is put back (same rule as query credentials); a value an operation changed stays.REDACTEDnever reaches the API.Mergeand the SDK's own secret lists are removed.Latency
redactUrlon the already-stripped URL at record time, ~2.5 µs median (the record step itself costs ~21 µs; masking must happen before the spool file on disk). First call boots the engine once (~2.7 ms, ~0.7 MB).Before merging
composer.jsonpoints at a localpathrepository (../http-redact/packages/php); replace it with"mnfst/http-redact": "^1.0"from Packagist.backend/src/v1/__fixtures__/mnfst-php.wire.jsonlin mnfst/app fromphp scripts/wire-fixtures.php(checked locally:sdk-wire.spec.tspasses on the new bytes).Tests
331 pass: new
MaskedTestandReplayRestoreTest(restore, shape changes, mask never sent, userinfo with@), old masking tests ported. A security review (probes on every outbound channel and on restore placement) found no unmasked channel; its three Important findings are fixed in this branch.The integration suite has a pre-existing intermittent failure (one random test, roughly one run in three, e.g.
TrackingTest::testOutOfRangeRecordsAreNeverWritten);mainshows the same rate. Not addressed here.