Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Should "sensitive" header types set HeaderValue::is_sensitive?

Open
#9 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
rust
Domain
backend-api-design, networking

Research direction

Start with the linked HeaderValue::is_sensitive documentation, then trace how Authorization, Cookie, and Set-Cookie are encoded into HeaderValue values. The issue names no files or tests; done requires an agreed set of sensitive header types and verified behavior for HPACK indexing and Debug output.

Written by the indexing model from the issue text.

Description

rfc

There is an attribute of HeaderValue that marks it as "sensitive". This currently has 2 effects:

  • In HTTP2, the HPACK never-indexed-literals flag is set. This keeps the value from being stored in the dynamic HPACK table.
  • Alters the Debug output to simply write the word "Sensitive" instead of the actual bytes, which can help with accidental storage of secrets or PII.

Should these potentially sensitive headers set this flag when encoding to a HeaderValue?

  • Authorization
  • Cookie
  • Set-Cookie
  • Others?
Dominant language
Rust
Stars
200
Forks
107
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from hyperium/headers

All issues in hyperium/headers

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.