Scrub auth tokens anywhere

[jjbayer]

Currently we do not scrub bearer tokens everywhere, e.g.

{
    "vars": {
        "headers": [
            ["authorization", "Bearer abc123"]
        ]
    }
}

We do not treat ["authorization", "Bearer abc123"] as a key-value pair, so we scrub the key, but not the value (see code).

Possible solutions:

1. Redact Bearer <hex> anywhere in a string (as we do for credit card numbers).
2. Build a heuristic that treats list of pairs as key-value mappings.

[olksdr]

Actions:

• We want to try to implement option 2 - this is more generic and should support and catch more stuff.
  • make the rules match on pairs

[antonpirker]

Maybe related:
We have an issue in the Python SDK repo: getsentry/sentry-python#2417

A user sends a Breadcrumb that contains sensitive data in the breadcrumb message (see reproduction event here: https://sentry-sdks.sentry.io/issues/4535377485/?project=5461230&query=is%3Aunresolved&referrer=issue-stream&statsPeriod=30d&stream_index=4 )

The breadcrumb message string contains 'Authentication': 'SECRET' which is not scrubbed by Relay.

[dcramer]

I'd start with implementing this on the server, and probably just have it be a "scrub-next-token" behavior if the value is identified in a tuple/list. Obviously you could look for tuples, and I'm sure next token won't always be valid, but given the intent of scrubbers its always better to be safe.

[Dav1dde]

Option 1 was implemented with #3484