Skip to content

fix: redact sensitive headers in debug logs (fixes #1196) #2977

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rookweb1 wants to merge 1 commit into
base: main
Choose a base branch
from
+24 −5
Open

fix: redact sensitive headers in debug logs (fixes #1196) #2977

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 24 additions & 5 deletions src/openai/_base_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -476,18 +476,37 @@ def _prepare_url(self, url: str) -> URL:
def _make_sse_decoder(self) -> SSEDecoder | SSEBytesDecoder:
return SSEDecoder()

def _redact_sensitive_headers(self, headers):
"""Redact sensitive headers (API keys, auth tokens) for safe logging."""
if not headers or not isinstance(headers, dict):
return headers

redacted = {}
sensitive_keys = {
"authorization", "api-key", "x-api-key",
"x-openai-api-key", "openai-api-key"
}

for key, value in headers.items():
key_lower = key.lower()
if any(sensitive in key_lower for sensitive in sensitive_keys):
redacted[key] = "[REDACTED]"
else:
redacted[key] = value

return redacted

def _build_request(
self,
options: FinalRequestOptions,
*,
retries_taken: int = 0,
) -> httpx.Request:
if log.isEnabledFor(logging.DEBUG):
log.debug(
"Request options: %s",
model_dump(
options,
exclude_unset=True,
safe_options = options.model_dump()
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use compat model_dump for Pydantic v1 support

Calling options.model_dump() directly here drops the compatibility layer used elsewhere in the repo; under Pydantic v1, FinalRequestOptions (a pydantic.BaseModel) does not guarantee a model_dump method, so enabling DEBUG logging can raise AttributeError before the request is built. This should keep using the existing compatibility helper to avoid version-specific runtime failures.

Useful? React with 👍 / 👎.

if "headers" in safe_options:
safe_options["headers"] = self._redact_sensitive_headers(safe_options["headers"])
log.debug("Request options: %s", safe_options)
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P0 Badge Restore a syntactically valid debug logging block

This line terminates log.debug(...) after only two arguments, but the old indented exclude=... argument block is still present below, which makes the module fail to parse (IndentationError at import time). As a result, importing openai._base_client breaks and the SDK cannot run.

Useful? React with 👍 / 👎.

# Pydantic v1 can't dump every type we support in content, so we exclude it for now.
exclude={
"content",
Expand Down