search

ropensci / vcr

Record HTTP calls and replay them
https://docs.ropensci.org/vcr
Other
77 stars 12 forks source link

On OAuth and secret purging #200

Closed maelle closed 3 years ago

maelle commented 3 years ago

Cf https://github.com/rladies/meetupr/pull/84

My biggest fear with OAuth is that at the time of vcr configuration there is a token but what if it gets refreshed later whilst running the tests and recording? Then it is in my cassettes, not in my config.

So I would really like a way to say that what is supposed to be edited is the authorization header, that would not be a regular expression.

maelle commented 3 years ago

It might be included in other issues about secret purging, but I wanted to report my experience in case it is relevant 🙂

sckott commented 3 years ago

Even if a oauth token changes, as long as you use the same env var name to get the token then it should work.

I think the targeted specific header filtering will address this https://github.com/ropensci/vcr/issues/182#issuecomment-730494747

maelle commented 3 years ago

The problem is that it can't be an environment variable, or at least isn't in the workflow I have seen.

Great reg targeted header filtering!

maelle commented 3 years ago

Duplicate of #182