filiphric / cypress-plugin-api

Cypress plugin to show your API information in the Cypress UI runner
ISC License
264 stars 35 forks source link

Hide token in response after request #91

Open GuiOliveira-WaProject opened 1 year ago

GuiOliveira-WaProject commented 1 year ago

We are currently able to hide certain parameters from the header, but when making a request to fetch a token, the token ends up being displayed in the request response, making it meaningless to hide the header since the sensitive data is still visible

image

Exemple to hide this response: image

filiphric commented 1 year ago

I wouldn’t say it’s meaningless as you may want to test value of that token. but I agree that expanding hiding credentials to include response might be useful in some cases. much trickier to implement I am guessing, because the access_token e.g. can be nested inside an array of objects or something.

I’ll think of a solution for this.

btw why exactly do you need to have this hidden? does this appear on some screenshots? what exactly is the use case that you are aiming for here?

GuiOliveira-WaProject commented 1 year ago

This request is inside a before, I use this token for authentication in the request of another endpoint, and I also hide this token in the header of the test request, it makes no sense for it to appear in the before response.

It really must be more complicated to implement, but we can find some way to uncapsulate this value and hide it. I'm guessing, you are the genius here LOL

I am happy to be able to participate in this community, thank you for your commitment and for this magnificent plugin.

filiphric commented 1 year ago

That makes a lot of sense, thanks for giving me the example, it really helps me understand the "why" behind your request 👍

For the use case you described, you can use plain cy.request() in your beforeEach() hook as a quick fix, but I will think about some elegant way of solving the missing support for hiding response credentials

GuiOliveira-WaProject commented 1 year ago

I use requestMode, I thought that disabling requestMode only for the before would work, but I haven't found a way to do that

JonathanSTH commented 1 year ago

Just dropping in echoing the exact case outlined. Will go with the cy.request() workaround for now.