Module redact 

Header-name redaction list applied to network.json by default (and to any tool-originated log line). Per design.md §"Secrets are redacted", credential-bearing headers are replaced with "[redacted]" unless the caller passes --no-network-redact.

Server response bodies pass through unmodified — redaction is for tool-captured metadata only.

Constants

ALWAYS_REDACTED

Header names that are always redacted (case-insensitive match).

REDACTED_SUFFIXES

Header-name suffixes that trigger redaction (case-insensitive match against the full header). Catches x-api-token, x-csrf-token, x-shared-secret, etc.

REDACTED_VALUE

Sentinel string written in place of redacted values.

URL_SECRET_NAMES

Legacy/common URL query parameter names that carry credentials but cannot be renamed by afhttp because they belong to third-party sites.

Functions

redact_url

Redact credentials from one URL, including userinfo and common third-party query parameter names.

redact_url_fields

Redact third-party credential parameters only inside _url/_URL fields.

redact_userinfo_passwords

Mask the password component of every scheme://user:pass@host userinfo found in arbitrary text, leaving the rest byte-for-byte intact.

redact_value

Apply afhttp’s URL compatibility policy followed by standard AFDATA value redaction.

should_redact

Returns true if header_name should be redacted under the default policy. Case-insensitive.