Mask the Authorization header

[HaroldPutman]

Address issue JENKINS-39744 by always masking the “Authorization” header value.

This pipeline script

#!groovy

httpRequest httpMode: 'GET',
  url: "https://httpbin.org/get",
  customHeaders: [[name: 'Authorization', value: "Basic dXNlcm5hbWU6cGFzc3dvcmQ="]]

Gives this result.

[Pipeline] httpRequest
HttpMode: GET
URL: https://httpbin.org/get
Authorization: *****
Sending request to url: https://httpbin.org/get
Response Code: HTTP/1.1 200 OK
Success code from [100‥399]
[Pipeline] End of Pipeline

instead of echoing the value Basic dXNlcm5hbWU6cGFzc3dvcmQ= which is easily decoded into username:password.

[HaroldPutman]

@janario ?

[fatganz]

This definitely would be useful! I am dealing with Github token and really feel that masking it will improve our security :)

[HaroldPutman]

Until this PR is incorporated, Here is a workaround that depends on the Mask Passwords plugin.

def creds = "user:secret"
String auth = creds.bytes.encodeBase64().toString()
wrap([
    $class: 'MaskPasswordsBuildWrapper',
    varPasswordPairs: [[var: 'XYZ', password: auth]]
    ]) {
    httpRequest httpMode: 'GET',
        url: "https://httpbin.org/get",
        customHeaders: [[name: 'Authorization', value: "Basic $auth"]]
}
'''

[wpc009]

Should have some configurable options to turn the verbose print off.

[wpc009]

It's should be debugging purpose only

[janario]

Merged.
Thanks, I'm going to release it soon