Scrub API Keys from Logs

[pearkes]

We should replace them with something innocuous. As we're just falling back to Faraday's logging, I'm not sure if this is possible or how we might do it.

[petems]

I'm having a stab at this, I'm trying to figure out where on the stack I should put it?

I've got a working middleware version for faraday
https://github.com/petems/faraday-scrublogs

Or it could be done it on faraday itself?

Or it could be done on digital_ocean? Hmm....

[pearkes]

I would say it would be cool if it could be done upstream on digital_ocean, as it seems like a relatively worthwhile feature.

@rmoriz hope you don't mind a ping, do you have an opinion on this type of thing? We're seeing a slight security concern with users pasting debug logs generated with the debug flag for the digital_ocean gem turned on, as it dumps HTTP URLs with access_tokens/client_ids visible.

The only issue I see with upstream is how do you configure it to scrub / not scrub. Sometimes it would be worthwhile to get raw output. Perhaps we should just do it on our side.

[petems]

I opened a PR on faraday with an implementation: lostisland/faraday#286 😸