替换VCR-gem盒式磁带请求正文中的敏感数据

Question

我可以使用filter_sensitive_data删除敏感标头，但它似乎无法替换请求正文中的敏感数据。

VCR配置

VCR.configure do |config|
config.cassette_library_dir = 'spec/vcr'
config.hook_into :webmock
config.configure_rspec_metadata!
# this does not work for request body
config.filter_sensitive_data('<PASSWORD-REDACTED>') do
ENV['PASSWORD']
end
# this works for headers
config.filter_sensitive_data('<Authorization-REDACTED>') do |interaction|
interaction.request.headers['Authorization'].try(:first)
end
end

运行规范

PASSWORD=secret bin/rspec spec/my_spec.rb

暗盒

记录在请求主体中包含password=secret

但应该是password=PASSWORD-REDACTED

---
http_interactions:
- request:
method: post
uri: https://xxxx
body:
encoding: US-ASCII
string: username=somebody%40example.com&password=secret
headers:
Accept:
- application/json
Content-Type:
- application/x-www-form-urlencoded
User-Agent:
- Faraday v2.2.0
Accept-Encoding:
- gzip;q=1.0,deflate;q=0.6,identity;q=0.3
response:
status:
code: 200
message: OK
headers:
...

Answer 1

对我来说效果很好。您可能需要检查filter_sensive_data块返回的值，如下所示https://relishapp.com/vcr/vcr/v/1-10-1/docs/configuration/filter-sensitive-data

替换字符串。这是将作为占位符写入盒式磁带文件的字符串。它应该是唯一的，并且您可能希望用特殊字符(如｛｝或<gt；。

确保块返回的字符串是唯一的。

在您的情况下，如果返回正确，我将检查ENV['PASSWORD']和
interaction.request.headers['Authorification'].ttry(：first(的值。