HttpExchangeTracer#postProcessRequestHeaders is never called

[Sarvesh-D]

Hi, my use case is to remove/sanitize a specific custom header from the response of /httptrace endpoint. I did some digging in the code and tried to provide my own implementaion of HttpExchangeTracer which has postProcessRequestHeaders() method. I overrode this method to sanitize my custom header. But it didn't work. On doing some more digging, i noticed that postProcessRequestHeaders() method is not being called from anywhere. I am on Spring Boot 2.0.3.
I checked the code of Spring Boot 1.5.7, and found that there is class called WebRequestTraceFilter which has method postProcessRequestHeaders(). In boot 1.5.7 this method is being called from a private method org.springframework.boot.actuate.trace.WebRequestTraceFilter.getRequestHeaders(HttpServletRequest).
Is there a simple way of achieveing what i am trying to achieve.
Few things i tried in spring boot 2.0.3:

• tried overriding org.springframework.boot.actuate.web.trace.servlet.TraceableHttpServletRequest.getHeaders() but the class itself is final and package-private.
• triedd overriding org.springframework.boot.actuate.trace.http.HttpExchangeTracer.FilteredTraceableRequest.getHeaders() but again same issue.

[snicoll]

my use case is to remove/sanitize a specific custom header from the response of /httptrace endpoint.

As far as I can see only a defined set of headers are included (your custom header won't). This looks like something we did on purpose (can't trace back why at the moment) so that protected method is probably an oversight and should have been removed. Does that custom header shows at the moment? What is the name of the header?

[Sarvesh-D]

Thanks for quick response. The custom header is visible in the traces. The name is management-access-token, we are using this header to secure access to management/actuator endpoints.

[philwebb]

I think it's a bug that we don't offer some way to do this, even if it's not via postProcessRequestHeaders.

[snicoll]

Yes, I've some polish locally already and forgot to report here.

[Sarvesh-D]

@snicoll just a suggestion.. can you make this possible by adding a configuration property to HttpTraceProperties, say management.trace.http.request.headers.sanitize or management.trace.http.request.headers.exclude. IMHO this would be more intuitive to clients instead of overriding the postProcessRequestHeaders method.

[snicoll]

Sorry but that's not the plan in this very issue. We're going to restore the 1.5.x behaviour but feel free to open a separate issue for that suggestion.