httpx

Documentation

Overview

Package httpx holds small HTTP helpers shared across packages whose behavior is security-sensitive enough that duplication would be a risk.

RedactTransportErr existed as two independent near-copies — internal/notify.redactTransportErr (#319/#389) and internal/enrich.redactURLErr (#294/#436) — and a hardening applied to one could silently miss the other (issue #439). Both now delegate here; the per-package secret-leak gates keep guarding their call sites.

Index

• func RedactTransportErr(err error, keepHost bool) error

Functions

func RedactTransportErr

func RedactTransportErr(err error, keepHost bool) error

RedactTransportErr strips the request URL from an HTTP transport error before it is wrapped, logged, or shown to an operator (Hard Rule 3, SECURITY-REVIEW §4).

http.Client.Do always returns *url.Error, whose Error() embeds the full request URL — and so does http.NewRequestWithContext when the URL fails to parse — so BOTH error paths must pass through here. net/http redacts only userinfo passwords, never path or query, so the raw error must not propagate: secrets ride in URL paths (Telegram bot tokens), queries (MaxMind license keys), or the whole URL (webhook capability URLs).

keepHost controls how much survives. For a well-known public API host (Telegram, Slack, Discord, MaxMind) scheme+host aid debugging and are not secret, so only the path/query is dropped. For a generic webhook the operator's host can itself be secret (an internal name, or a capability URL on an obscure host), so the whole URL collapses to "[redacted]" and the transport cause is reduced to a fixed classification (issue #360, CWE-209).