Sanitization

Sanitization will help you to protect sensitive data (passwords, secret keys, etc.) from leakage.

You should always sanitize the log, so no personal tokens and/or keys can leak.

If you don't use sanitization at all, the request and response logs will not be available in the console.

With correct sanitization

Example of log from console with sanitized access token

...
"log": {
		"sanitize": ["request.headers.accesstoken"]
	}
...

Accesstoken is correctly mapped, therefore it is not exposed.

Without sanitization

Output from Scenario Debugger

Without sanitization, there will be no log in the list of executions in Live Stream.

At the same time, there will be no shown log in Scenario Debugger, as in the screenshot above.

Either developer or user can't see the original request and response, and debug possible issues.

With wrong sanitization

Example of log from console with exposed access token

...
"log": {
		"sanitize": ["request.headers.token"]
	}
...

Notice, the accesstoken was misplaced for token. Therefore the accesstoken was exposed in the log.

Even though there are many standardized authorization protocols (like OAuth 2), there are many services thinking they can do it better so remember to check how the service implements the authorization and set it up correctly.