Authorization leak through headers

[bjorn-lw]

If "test" is specified in the call to PBS, the debug info coming back contains all headers sent to the endpoints.

e.g. There can be a basic authentication key exposed. Even though it's not the actual user/password it feels like not something that should be publicly exposed.

[bretg]

Thanks for the bug report @bjorn-lw

[SyntaxNode]

Good catch. We missed that some adapters use the authorization header.

Are you ok with us keeping the header debugging feature and replacing the content of the auth header with a literal <HIDDEN BY PREBID SERVER> value?

[bjorn-lw]

I think the feature is awesome otherwise and masking would be good enough.

[SyntaxNode]

The adapter in question prefers for the header to be removed entirely, rather than masked.