API logs expose cookies, proxy credentials, and request/response secrets

Have you checked our README?

• I have checked the README

Have you followed our Troubleshooting?

• I have followed your Troubleshooting

Is there already an issue for your problem?

• I have checked older issues, open and closed

Have you checked the discussions?

• I have read the Discussions

Have you ACTUALLY checked all these?

YES

Environment

- FlareSolverr version: master at 0f05ed8fc974b215c36892b5a30122e27fe3c671
- Last working FlareSolverr version: unknown
- Operating system: Ubuntu 24.04 (remote deployment inspection)
- Are you using Docker: yes
- FlareSolverr User-Agent (see log traces or / endpoint): not applicable
- Are you using a VPN: no
- Are you using a Proxy: yes
- URL to test this issue: any endpoint sending authenticated cookies or proxy credentials

Description

Description

The API controller logs the complete request payload at INFO level and the complete response object at DEBUG level. Those structures can contain cookies, headers, passwords, post data, proxy URLs and credentials, response HTML, screenshots, and CAPTCHA tokens. A default deployment can therefore persist secrets in service logs.

Expected behaviour

Operational logs should retain useful metadata while masking authentication material and sensitive request and response fields.

Proposed fix

Add a recursive redaction helper for known sensitive keys, use it for incoming request and debug response logs, and preserve only non-sensitive metadata. A focused test verifies that representative secrets do not appear in the logged output.

Logged Error Messages

No service failure is required; the exposure is visible in normal request logging when sensitive fields are supplied.

Screenshots

No response