{"action":"created","issue":{"url":"https://api.github.com/repos/cloudant/nodejs-cloudant/issues/85","labels_url":"https://api.github.com/repos/cloudant/nodejs-cloudant/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/cloudant/nodejs-cloudant/issues/85/comments","events_url":"https://api.github.com/repos/cloudant/nodejs-cloudant/issues/85/events","html_url":"https://github.com/cloudant/nodejs-cloudant/issues/85","id":102239874,"number":85,"title":"Remove credentials from error responses","user":{"login":"glynnbird","id":697925,"avatar_url":"https://avatars.githubusercontent.com/u/697925?v=3","gravatar_id":"","url":"https://api.github.com/users/glynnbird","html_url":"https://github.com/glynnbird","followers_url":"https://api.github.com/users/glynnbird/followers","following_url":"https://api.github.com/users/glynnbird/following{/other_user}","gists_url":"https://api.github.com/users/glynnbird/gists{/gist_id}","starred_url":"https://api.github.com/users/glynnbird/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glynnbird/subscriptions","organizations_url":"https://api.github.com/users/glynnbird/orgs","repos_url":"https://api.github.com/users/glynnbird/repos","events_url":"https://api.github.com/users/glynnbird/events{/privacy}","received_events_url":"https://api.github.com/users/glynnbird/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cloudant/nodejs-cloudant/labels/Agenda","name":"Agenda","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-08-20T21:19:58Z","updated_at":"2015-09-02T08:15:29Z","closed_at":null,"body":"The `err` variable returned in the callback function contains the Cloudant login credentials. Could we modify the `relax` function in Nano to remove this?"},"comment":{"url":"https://api.github.com/repos/cloudant/nodejs-cloudant/issues/comments/136972332","html_url":"https://github.com/cloudant/nodejs-cloudant/issues/85#issuecomment-136972332","issue_url":"https://api.github.com/repos/cloudant/nodejs-cloudant/issues/85","id":136972332,"user":{"login":"jhs","id":17575,"avatar_url":"https://avatars.githubusercontent.com/u/17575?v=3","gravatar_id":"","url":"https://api.github.com/users/jhs","html_url":"https://github.com/jhs","followers_url":"https://api.github.com/users/jhs/followers","following_url":"https://api.github.com/users/jhs/following{/other_user}","gists_url":"https://api.github.com/users/jhs/gists{/gist_id}","starred_url":"https://api.github.com/users/jhs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhs/subscriptions","organizations_url":"https://api.github.com/users/jhs/orgs","repos_url":"https://api.github.com/users/jhs/repos","events_url":"https://api.github.com/users/jhs/events{/privacy}","received_events_url":"https://api.github.com/users/jhs/received_events","type":"User","site_admin":false},"created_at":"2015-09-02T08:15:29Z","updated_at":"2015-09-02T08:15:29Z","body":"Rather than omit the headers, perhaps scrub them? I have done that in the past to keep passwords out of log files.\r\n\r\nAn advantage of that technique is that it also makes us safe during logging. I think users could currently hook into our log/debug callbacks and inadvertently log their credentials. (Arguably that is their problem; however considering how much is at stake to lose control of cloud database credentials, I'd argue we should never let such secrets \"leak\" from this package.)\r\n\r\nThe disadvantage though is that there is a higher risk of doing it wrong. We'd need to scrub URLs with credential prefixes, \"Authorization\" headers, probably cookie headers, etc. and we'd want to be reasonably sure we did it correctly."}}