Looks like it only checks for authorization: redaction in the headers which is great, but continues to leak the authorization header in batched http calls for Google APIs
IOW, a fine start, but one should still actually check har files for stanzas that are relevant to your authn/authz situation before sharing them with anyone
>The tool is built entirely on Cloudflare Workers, and all sanitization is done client-side which means Cloudflare never sees the full contents of the session token.
There is a new feature request for Chromium to strip this information by default, so people don't have to be educated to do any action like uploading it to Cloudflares tool!
I'm kinda missing this in the next steps defined by Cloudflare...
8 comments
[ 3.4 ms ] story [ 30.0 ms ] threadPurpose and fit seems to be lost, here.
IOW, a fine start, but one should still actually check har files for stanzas that are relevant to your authn/authz situation before sharing them with anyone
>The tool is built entirely on Cloudflare Workers, and all sanitization is done client-side which means Cloudflare never sees the full contents of the session token.
I'm kinda missing this in the next steps defined by Cloudflare...
https://bugs.chromium.org/p/chromium/issues/detail?id=149580...