fix(observability): redact sink-specific API key headers in debug logs (#25516)

* fix(observability): redact sink-specific API key headers in debug logs

Expand the sensitive header list in `remove_sensitive()` to cover
`DD-API-KEY`, `X-Honeycomb-Team`, `x-api-key`, and `Api-Key`, which
are injected by Vector's own sinks and were previously logged in
plaintext when debug logging was enabled.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(observability): mark all duplicate sensitive header values in debug logs

`HeaderMap::get_mut` only returned the first value for a header name,
leaving any duplicates (added via `append` or injected by a proxy)
unredacted. Switch to `iter_mut` so every entry matching a sensitive
name is marked.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: apply rustfmt to http_client tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(observability): add case-insensitive header name test

HeaderName normalizes to lowercase, confirming that mixed-case variants
like X-Api-Key are redacted by the same path as x-api-key.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(observability): add Proxy-Authenticate, WWW-Authenticate, and Cookie2 to sensitive headers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: update changelog to include newly redacted headers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: pront

changelog.d/redact-sink-api-key-headers.security.md

@@ -0,0 +1,3 @@
+Redact sink-specific API key headers (`DD-API-KEY`, `X-Honeycomb-Team`, `x-api-key`, `Api-Key`) in debug-level HTTP request and response logs, alongside the existing standard headers (`Authorization`, `Proxy-Authorization`, `Proxy-Authenticate`, `WWW-Authenticate`, `Cookie`, `Set-Cookie`, `Cookie2`).
+
+authors: pront

src/internal_events/http_client.rs

@@ -2,7 +2,7 @@ use std::time::Duration;
 
 use http::{
     Request, Response,
-    header::{self, HeaderMap, HeaderValue},
+    header::{self, HeaderMap, HeaderName, HeaderValue},
 };
 use hyper::{Error, body::HttpBody};
 use vector_lib::{
@@ -17,13 +17,21 @@ pub struct AboutToSendHttpRequest<'a, T> {
 
 fn remove_sensitive(headers: &HeaderMap<HeaderValue>) -> HeaderMap<HeaderValue> {
     let mut headers = headers.clone();
-    for name in &[
+    let sensitive: &[HeaderName] = &[
         header::AUTHORIZATION,
         header::PROXY_AUTHORIZATION,
+        header::PROXY_AUTHENTICATE,
+        header::WWW_AUTHENTICATE,
         header::COOKIE,
         header::SET_COOKIE,
-    ] {
-        if let Some(value) = headers.get_mut(name) {
+        HeaderName::from_static("cookie2"),
+        HeaderName::from_static("dd-api-key"),
+        HeaderName::from_static("x-honeycomb-team"),
+        HeaderName::from_static("x-api-key"),
+        HeaderName::from_static("api-key"),
+    ];
+    for (name, value) in headers.iter_mut() {
+        if sensitive.contains(name) {
             value.set_sensitive(true);
         }
     }
@@ -114,3 +122,78 @@ impl<B: HttpBody> std::fmt::Display for FormatBody<'_, B> {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use http::header::{self, HeaderMap, HeaderName, HeaderValue};
+
+    use super::remove_sensitive;
+
+    fn is_sensitive(map: &HeaderMap, name: &HeaderName) -> Vec<bool> {
+        map.get_all(name)
+            .iter()
+            .map(HeaderValue::is_sensitive)
+            .collect()
+    }
+
+    #[test]
+    fn marks_single_sensitive_header() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::AUTHORIZATION,
+            HeaderValue::from_static("Bearer token"),
+        );
+        let result = remove_sensitive(&headers);
+        assert!(
+            is_sensitive(&result, &header::AUTHORIZATION)
+                .iter()
+                .all(|&s| s)
+        );
+    }
+
+    #[test]
+    fn marks_all_duplicate_sensitive_headers() {
+        let x_api_key: HeaderName = HeaderName::from_static("x-api-key");
+        let mut headers = HeaderMap::new();
+        headers.insert(x_api_key.clone(), HeaderValue::from_static("key-one"));
+        headers.append(x_api_key.clone(), HeaderValue::from_static("key-two"));
+        headers.append(x_api_key.clone(), HeaderValue::from_static("key-three"));
+
+        let result = remove_sensitive(&headers);
+        let sensitive_flags = is_sensitive(&result, &x_api_key);
+        assert_eq!(sensitive_flags.len(), 3);
+        assert!(
+            sensitive_flags.iter().all(|&s| s),
+            "not all duplicate x-api-key values were marked sensitive: {sensitive_flags:?}"
+        );
+    }
+
+    #[test]
+    fn header_name_matching_is_case_insensitive() {
+        // HeaderName normalizes to lowercase, so mixed-case variants are identical.
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            HeaderName::from_static("x-api-key"),
+            HeaderValue::from_static("secret"),
+        );
+        let result = remove_sensitive(&headers);
+        // Lookup with the mixed-case form resolves to the same normalized name.
+        let mixed_case = HeaderName::from_bytes(b"X-Api-Key").unwrap();
+        assert!(is_sensitive(&result, &mixed_case).iter().all(|&s| s));
+    }
+
+    #[test]
+    fn does_not_mark_non_sensitive_headers() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("application/json"),
+        );
+        let result = remove_sensitive(&headers);
+        assert!(
+            is_sensitive(&result, &header::CONTENT_TYPE)
+                .iter()
+                .all(|&s| !s)
+        );
+    }
+}