Repository: honeybadger-io/honeybadger-python

Issue:
Filter sensitive HTTP headers with params_filters
See https://github.com/honeybadger-io/honeybadger-python/pull/39#issuecomment-573796861

I'm not sure how to do this for Flask; for Django, it looks like we could do something like this, like we do for Session:

https://github.com/honeybadger-io/honeybadger-python/blob/master/honeybadger/contrib/django.py#L90

```python
        # ...

        payload = {
            'url': request.build_absolute_uri(),
            'component': request.resolver_match.app_name,
            'action': request.resolver_match.func.__name__,
            'params': {},
            'session': {},
            'cgi_data': {},
            'context': context
        }

        if hasattr(request, 'META'):
            payload['cgi_data'] = filter_dict(dict(request.META), config.params_filters)

        # ...
```

This should then add `CSRF_COOKIE` as a default option to `params_filters`.

Discussion:
Kelvin4664: > Looking good @Kelvin4664. 🎉
> 
> Just a few suggestions:
> 
> 1. See suggested changes to cgi_data key names
> 2. Can you add a [changelog](https://github.com/honeybadger-io/honeybadger-python/blob/master/CHANGELOG.md) entry under the "Unreleased" heading? [Here's an example entry that I added recently](https://github.com/honeybadger-io/honeybadger-python/commit/3058f047cb56ceb7b3d51703f8506bd240c61075#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4ed).
> 3. In the future it would help to reference the issues that this is fixing in the PR description. (I went ahead and updated the description on this one)
> 
> Thanks!

Thanks Josh..
All resolved.



Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 799930b..a2fc5e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ CHANGELOG](http://keepachangelog.com/) for how to update this file. This project
 adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
+### Added
+- Add `CSRF_COOKIE` to default filter_params (#44)
+- Add `HTTP_COOKIE` to payload for flask & django (#44)
+- Filter meta (cgi_data) attributes for flask & django (#43)
 
 ## [0.4.2] - 2021-02-04
 ### Fixed
diff --git a/honeybadger/config.py b/honeybadger/config.py
index f983f99..1f3abd5 100644
--- a/honeybadger/config.py
+++ b/honeybadger/config.py
@@ -22,7 +22,7 @@ class Configuration(object):
         self.environment = 'production'
         self.hostname = socket.gethostname()
         self.endpoint = 'https://api.honeybadger.io'
-        self.params_filters = ['password', 'password_confirmation', 'credit_card']
+        self.params_filters = ['password', 'password_confirmation', 'credit_card', 'CSRF_COOKIE']
         self.force_report_data = False
 
         self.set_12factor_config()
diff --git a/honeybadger/contrib/django.py b/honeybadger/contrib/django.py
index 1cd7c48..ed3aea9 100644
--- a/honeybadger/contrib/django.py
+++ b/honeybadger/contrib/django.py
@@ -74,13 +74,16 @@ class DjangoPlugin(Plugin):
             'action': request.resolver_match.func.__name__,
             'params': {},
             'session': {},
-            'cgi_data': dict(request.META),
+            'cgi_data': filter_dict(request.META, config.params_filters),
             'context': context
         }
 
         if hasattr(request, 'session'):
             payload['session'] = filter_dict(dict(request.session), config.params_filters)
 
+        if hasattr(request, 'COOKIES'):
+            payload['cgi_data']['HTTP_COOKIE'] = filter_dict(request.COOKIES, config.params_filters)
+
         if request.method == 'GET':
             payload['params'] = filter_dict(dict(request.GET), config.params_filters)
             
diff --git a/honeybadger/contrib/flask.py b/honeybadger/contrib/flask.py
index 91cdab8..455f1e0 100644
--- a/honeybadger/contrib/flask.py
+++ b/honeybadger/contrib/flask.py
@@ -51,7 +51,8 @@ class FlaskPlugin(Plugin):
             for k, v in iteritems(_request.headers)
         }
         cgi_data.update({
-            'REQUEST_METHOD': _request.method
+            'REQUEST_METHOD': _request.method,
+            'HTTP_COOKIE' : dict(_request.cookies)
         })
         payload = {
             'url': _request.base_url,
@@ -59,7 +60,7 @@ class FlaskPlugin(Plugin):
             'action': _request.endpoint,
             'params': {},
             'session': filter_dict(dict(session), config.params_filters),
-            'cgi_data': cgi_data,
+            'cgi_data': filter_dict(cgi_data, config.params_filters),
             'context': context
         }
 


Test patch:
diff --git a/honeybadger/tests/contrib/test_flask.py b/honeybadger/tests/contrib/test_flask.py
index ba853f4..a62e3fa 100644
--- a/honeybadger/tests/contrib/test_flask.py
+++ b/honeybadger/tests/contrib/test_flask.py
@@ -96,7 +96,8 @@ class FlaskPluginTestCase(unittest.TestCase):
                 'Host': 'server:1234',
                 'Content-Type': 'application/x-www-form-urlencoded',
                 'Content-Length': '29',
-                'REQUEST_METHOD': 'POST'
+                'REQUEST_METHOD': 'POST',
+                'HTTP_COOKIE': {}
             })
             self.assertDictEqual(payload['context'], {'k': 'value'})
 
@@ -115,7 +116,8 @@ class FlaskPluginTestCase(unittest.TestCase):
                 'Host': 'server:1234',
                 'Content-Type': 'application/x-www-form-urlencoded',
                 'Content-Length': '29',
-                'REQUEST_METHOD': 'PUT'
+                'REQUEST_METHOD': 'PUT',
+                'HTTP_COOKIE': {}
             })
             self.assertDictEqual(payload['context'], {'k': 'value'})