search

postmanlabs / postman-app-support

Postman is an API platform for building and using APIs. Postman simplifies each step of the API lifecycle and streamlines collaboration so you can create better APIs—faster.
https://www.postman.com
5.81k stars 839 forks source link

Secret Variables visible 👀 on console #10650

Open ivikramsahu opened 2 years ago

ivikramsahu commented 2 years ago

Is there an existing issue for this?

Describe the Issue

The Variables which are set to secret type can be easily visible (unmasked) on console while debugging or screen sharing.

Steps To Reproduce

  1. Set an environment / global / collection variable to secret type.
  2. Use the variable in one of your API request.
  3. Open and clear your console tab
  4. Hit the send button to get the secret variable value visible.

Screenshots or Videos

No response

Environment Information

- Operating System: MAC OS Monterey
- Platform Type: Web
- Postman Version:

Additional Context?

No response

MichaelLeonardRavens commented 1 year ago

We need to send secrets in the body of a request in order to get back an auth token. It would really help to get this fixed so that the secrets are not published in pipeline run logs.

MichaelLeonardRavens commented 1 year ago

Just the ability to turn off JSON request body console logging for a specific request would be enough for us. If JSON worked like graphql (which is not logged automatically) then that would be fine.

anandvarkeyphilips commented 1 year ago

I am also waiting for a solution for this!

old-square-eyes commented 1 year ago

Keen. Any news?

ext-parul commented 10 months ago

Issue is still seen please help fix this issue or suggest an alternate

theonly1me commented 3 months ago

Hi folks, (@ivikramsahu @ext-parul @old-square-eyes @anandvarkeyphilips @MichaelLeonardRavens), we've now released the Postman Vault which is an encrypted local storage on Postman. You can use it to store your api keys, secrets or other sensitive information locally.

The secrets in your vault are only accessible by you and are masked in the console by default. You can learn more about the Vault on the Postman Learning Center page.