Package org.apache.juneau.http

Class RedactedQueryParams

java.lang.Object
org.apache.juneau.http.RedactedQueryParams
public final class RedactedQueryParams extends Object
Utility for masking the values of query-string parameters that commonly carry secrets (passwords, tokens, API keys) before a URI is written somewhere observable, such as a log line.

Parameter-name matching is case-insensitive. Only the value is masked; the parameter name and the rest of the URI are preserved.

String masked = RedactedQueryParams.redactUri("/a?user=bob&token=abc"); // masked == "/a?user=bob&token=[REDACTED]"

Since:
10.0.0

  • Field Details

    • DEFAULT

      public static final Set<String> DEFAULT
      Canonical set of query parameter names commonly used to carry secrets, matched case-insensitively.

  • Method Details

    • isSensitive

      public static boolean isSensitive(String name)
      Returns true if the given query parameter name is in DEFAULT (case-insensitive).
      Parameters:
      name - The parameter name to test. Can be null (returns false).
      Returns:
      true if the name is sensitive.

    • isSensitive

      public static boolean isSensitive(String name, Collection<String> names)
      Returns true if the given query parameter name matches one of names, case-insensitively.
      Parameters:
      name - The parameter name to test. Can be null (returns false).
      names - The candidate names. Can be null (returns false). null elements are ignored.
      Returns:
      true if the name is sensitive.

    • redactUri

      public static String redactUri(String uri)
      Masks the values of sensitive query parameters in a URI using DEFAULT.
      Parameters:
      uri - The URI or URI reference. Can be null (returned as-is).
      Returns:
      The URI with sensitive parameter values replaced by RedactedHeaders.REDACTED.

    • redactUri

      public static String redactUri(String uri, Collection<String> names)
      Masks the values of query parameters whose names match names in a URI.

      The parameter name is compared after percent-decoding. A fragment, if present, is left untouched.

      Parameters:
      uri - The URI or URI reference. Can be null (returned as-is).
      names - The sensitive parameter names. Can be null (nothing is masked).
      Returns:
      The URI with matching parameter values replaced by RedactedHeaders.REDACTED.