[FEATURE] Redact URL Parameters / Headers from Audit Logging

[stephen-crawford]

Is your feature request related to a problem?
Previously, #3885 added a new field to allow users to redact custom headers from audit logging. This allows users to specify which HTTP headers they want to ignore and can be useful when using the customization options for various authentication backends.

In the same vain, it would be helpful if there was way to redact request info from audit logging when the JWT URL parameter feature was being used since this can expose the same type of information. Specifically, the audit logging feature has no way to remove the URL parameter from the audit logging info leading to the token being recorded.

What solution would you like?
Ideally, the audit logging logic would be changed to redact the url parameter and its content from the logs. This would mean that instead of recording the entire request URL in the audit logging it would record only the parts of the path which do not correspond to the passed token.

What alternatives have you considered?
Another alternative is simply to update the documentation to let users know that it is not recommended to log the HTTP paths when using the custom url parameter heading.

[stephen-crawford]

[Triage] Going to mark this as triaged with the closure criteria being a documentation change which addresses the risk of audit logging the URLs with the customized URL parameters for tokens.

[cwperks]

Closing this issue as #4067 has been merged.