fix(HTTP Request Node): Sanitize authorization headers

packages/nodes-base/nodes/HttpRequest/GenericFunctions.ts

@@ -88,7 +88,14 @@ export function sanitizeUiMessage(
 			),
 		};
 	}
-
+	//redact headers with Base64 encoded credentials
+	const headers = sendRequest.headers as IDataObject;
+	if (headers) {
+		const headerKey = Object.keys(headers).find((key) => key.toLowerCase() === 'authorization');
+		if (headerKey) {
+			headers[headerKey] = REDACTED;
+		}
+	}
 	if (secrets && secrets.length > 0) {
 		return redact(sendRequest, secrets);
 	}

packages/nodes-base/nodes/HttpRequest/test/utils/utils.test.ts

@@ -136,5 +136,55 @@ describe('HTTP Node Utils', () => {
 				uri: 'https://example.com',
 			});
 		});
+		it('should redact the Authorization header', () => {
+			const requestOptions: IRequestOptions = {
+				method: 'POST',
+				uri: 'https://example.com',
+				body: { sessionToken: 'secret', other: 'foo' },
+				headers: { authorization: 'Bearer some-sensitive-token', other: 'foo' },
+				auth: { user: 'user', password: 'secret' },
+			};
+			const authDataKeys = {};
+			const sanitizedRequest = sanitizeUiMessage(requestOptions, authDataKeys);
+
+			expect(sanitizedRequest.headers).toEqual({ authorization: REDACTED, other: 'foo' });
+		});
+
+		it('should redact the Authorization header when the key starts with an uppercase letter', () => {
+			const requestOptions: IRequestOptions = {
+				method: 'POST',
+				uri: 'https://example.com',
+				body: { sessionToken: 'secret', other: 'foo' },
+				headers: { Authorization: 'Basic another-sensitive-token', other: 'foo' },
+				auth: { user: 'user', password: 'secret' },
+			};
+			const authDataKeys = {};
+			const sanitizedRequest = sanitizeUiMessage(requestOptions, authDataKeys);
+
+			expect(sanitizedRequest.headers).toEqual({ Authorization: REDACTED, other: 'foo' });
+		});
+
+		it('should leave headers unchanged if Authorization header is not present', () => {
+			const requestOptions: IRequestOptions = {
+				method: 'POST',
+				uri: 'https://example.com',
+				body: { sessionToken: 'secret', other: 'foo' },
+				headers: { other: 'foo' },
+				auth: { user: 'user', password: 'secret' },
+			};
+			const authDataKeys = {};
+			const sanitizedRequest = sanitizeUiMessage(requestOptions, authDataKeys);
+
+			expect(sanitizedRequest.headers).toEqual({ other: 'foo' });
+		});
+
+		it('should handle case when headers are undefined', () => {
+			const requestOptions: IRequestOptions = {};
+
+			const authDataKeys = {};
+			const sanitizedRequest = sanitizeUiMessage(requestOptions, authDataKeys);
+
+			expect(sanitizedRequest.headers).toBeUndefined();
+		});
 	});
 });