Sensitive Query Parameter Redactor (httputil/redact_query.go)

Go utility that redacts sensitive query parameters (tokens, codes, hints) from URLs before logging.

// Source: https://github.com/authgear/authgear-server | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
package httputil

import "net/url"

// SensitiveQueryParams lists query parameter names whose values must never
// appear verbatim in logs (e.g. request URLs), because they can carry
// identity tokens, PII, or one-time credentials.
var SensitiveQueryParams = []string{
	// OIDC end_session / authorization request hints.
	"id_token_hint",
	"login_hint",
	// Verification / password reset / tester callback links.
	"code",
	"token",
}

const RedactedQueryParamValue = "redacted"

// RedactedRawQuery returns rawQuery with the values of SensitiveQueryParams
// replaced, so it is safe to

... (truncated -- full source via MCP)