Repository: seanmonstar/reqwest (language: rust)

Issue:
Examples for `default_headers` should mark authorization headers sensitive.
There are numerous examples given of setting the Authorization header without the use of a helper method like `basic_auth` or `bearer`. They look something like this:

```rust
let mut headers = header::HeaderMap::new();
headers.insert(header::AUTHORIZATION, header::HeaderValue::from_static("secret"));
```

It would be a good idea to change the documentation so that, if the authorization header is used as the example, it shows how to properly mark the header as sensitive. Something like...

```rust
let mut headers = header::HeaderMap::new();
let mut value = header::HeaderValue::from_static("secret");
value.set_sensitive(true);
headers.insert(header::AUTHORIZATION, value);
```

Otherwise, there could be users who might see the docs, copy & paste, and not gain the benefit of sensitive headers.


Discussion / hints:
Sounds like a good idea to me! Perhaps with a line comment "authorization is sensitive", or with a separate example showing you don't need to do that with _all_ headers...

Fix patch:
diff --git a/src/async_impl/client.rs b/src/async_impl/client.rs
index a2ea20b8a..1ded44832 100644
--- a/src/async_impl/client.rs
+++ b/src/async_impl/client.rs
@@ -405,7 +405,12 @@ impl ClientBuilder {
     /// use reqwest::header;
     /// # async fn doc() -> Result<(), reqwest::Error> {
     /// let mut headers = header::HeaderMap::new();
-    /// headers.insert(header::AUTHORIZATION, header::HeaderValue::from_static("secret"));
+    /// headers.insert("X-MY-HEADER", header::HeaderValue::from_static("value"));
+    ///
+    /// // Consider marking security-sensitive headers with `set_sensitive`.
+    /// let mut auth_value = header::HeaderValue::from_static("secret");
+    /// auth_value.set_sensitive(true);
+    /// headers.insert(header::AUTHORIZATION, auth_value);
     ///
     /// // get a client builder
     /// let client = reqwest::Client::builder()
@@ -422,7 +427,7 @@ impl ClientBuilder {
     /// use reqwest::header;
     /// # async fn doc() -> Result<(), reqwest::Error> {
     /// let mut headers = header::HeaderMap::new();
-    /// headers.insert(header::AUTHORIZATION, header::HeaderValue::from_static("secret"));
+    /// headers.insert("X-MY-HEADER", header::HeaderValue::from_static("value"));
     ///
     /// // get a client builder
     /// let client = reqwest::Client::builder()
@@ -430,7 +435,7 @@ impl ClientBuilder {
     ///     .build()?;
     /// let res = client
     ///     .get("https://www.rust-lang.org")
-    ///     .header(header::AUTHORIZATION, "token")
+    ///     .header("X-MY-HEADER", "new_value")
     ///     .send()
     ///     .await?;
     /// # Ok(())
diff --git a/src/blocking/client.rs b/src/blocking/client.rs
index ea0766e54..ef3ce0c8b 100644
--- a/src/blocking/client.rs
+++ b/src/blocking/client.rs
@@ -136,8 +136,14 @@ impl ClientBuilder {
     /// use reqwest::header;
     /// # fn build_client() -> Result<(), reqwest::Error> {
     /// let mut headers = header::HeaderMap::new();
+    /// headers.insert("X-MY-HEADER", header::HeaderValue::from_static("value"));
     /// headers.insert(header::AUTHORIZATION, header::HeaderValue::from_static("secret"));
     ///
+    /// // Consider marking security-sensitive headers with `set_sensitive`.
+    /// let mut auth_value = header::HeaderValue::from_static("secret");
+    /// auth_value.set_sensitive(true);
+    /// headers.insert(header::AUTHORIZATION, auth_value);
+    ///
     /// // get a client builder
     /// let client = reqwest::blocking::Client::builder()
     ///     .default_headers(headers)
@@ -153,7 +159,7 @@ impl ClientBuilder {
     /// use reqwest::header;
     /// # fn build_client() -> Result<(), reqwest::Error> {
     /// let mut headers = header::HeaderMap::new();
-    /// headers.insert(header::AUTHORIZATION, header::HeaderValue::from_static("secret"));
+    /// headers.insert("X-MY-HEADER", header::HeaderValue::from_static("value"));
     ///
     /// // get a client builder
     /// let client = reqwest::blocking::Client::builder()
@@ -161,7 +167,7 @@ impl ClientBuilder {
     ///     .build()?;
     /// let res = client
     ///     .get("https://www.rust-lang.org")
-    ///     .header(header::AUTHORIZATION, "token")
+    ///     .header("X-MY-HEADER", "new_value")
     ///     .send()?;
     /// # Ok(())
     /// # }


Test patch: