[SEC-7656] Add Set-Cookie to default redacted headers

pkaeding · claude · pkaeding · commit ff5f15f32491 · 2026-02-13T09:45:08.000-05:00
Fixes SEC-7656. The Set-Cookie response header can contain session
cookies and should be redacted by default to prevent session hijacking.

Co-Authored-By: Claude Sonnet 4.5 &lt;noreply@anthropic.com&gt;
diff --git a/sdk/highlight-run/src/client/listeners/network-listener/utils/network-sanitizer.ts b/sdk/highlight-run/src/client/listeners/network-listener/utils/network-sanitizer.ts
@@ -55,6 +55,7 @@ const SENSITIVE_HEADERS = [
 	'authorization',
 	'cookie',
 	'proxy-authorization',
+	'set-cookie',
 	'token',
 ]
 

Original file line number	Diff line number	Diff line change
`@@ -55,6 +55,7 @@ const SENSITIVE_HEADERS = [`
`55`	`55`	`'authorization',`
`56`	`56`	`'cookie',`
`57`	`57`	`'proxy-authorization',`
	`58`	`+ 'set-cookie',`
`58`	`59`	`'token',`
`59`	`60`	`]`
`60`	`61`