core / pragma.http / HttpRequest /

HttpRequest #

data class HttpRequest(httpMethod: HttpMethod, uri: String, body: Any = EmptyContent, auth: HeaderAuthCredentialsProvider = EmptyAuthProvider, expectSuccess: Boolean, headers: Map<String, String> = mapOf(), parameters: Map<String, String> = mapOf(), tags: List<String>, compressBody: Boolean = false, sensitiveValues: Map<String, String> = mapOf())

An outbound HTTP request.

Sensitive values. Declare every secret or identity provider account ID the request carries in its URL, query parameters or path in sensitiveValues, as label to value, e.g. mapOf("steamWebApiKey" to key, "steamId" to steamId). When the request fails, TimedHttpClient replaces each declared value, raw or URL-encoded, with <<label>> in the exception it throws:

• 3xx, 4xx and 5xx responses: the request URL and response text in ktor’s io.ktor.client.plugins.ResponseException message. The exception keeps its ktor type, and e.response still reads the original status, headers and body.
• Failures without a response, such as timeouts: every message in the HttpRequestFailedException cause chain.

Only declared values are redacted, so an undeclared secret in the URL reaches the logs. Values sent only in headers (including auth) or in the request body don’t appear in exception messages and don’t need declaring. Redaction doesn’t cover what callers log themselves, such as e.response.bodyAsText() or an ID interpolated into a log message.

An HttpClient wrapper that builds a new request must use copy, which carries the private declarations. Rebuilding the request field by field drops them.

Constructors #