When the ansible builtin uri module is given custom header with Authorization data, the REST API GET works and responds. But in the response date invocation object it shows the Authorization header that was provided as is without any masking or redact.
Is there some configuration I can use before submitting the uri request ?
3 Likes
The invocation is a general part of debug output for tasks, and won’t be displayed if you use less verbosity than -vvv. The no_log keyword can also be used more generally to hide task details.
I did not change the default verbosity 0 or -v, and I still notice the header and Authorization content in the response.
otoh - no-log is an option; but it would be nice to see what happened with uri module particularly when API calls fail
If it’s not in the invocation, add Authorization to unredirected_headers. The invocation is deleted based on verbosity ansible/lib/ansible/plugins/callback/__init__.py at devel · ansible/ansible · GitHub, so setting that option won’t prevent it from still showing up when using a lot of verbosity.