From f980fc549247fa2deb87dfacebc6d8d13ccd45d1 Mon Sep 17 00:00:00 2001
From: Travis Tripp <travis.tripp@hp.com>
Date: Mon, 15 Sep 2014 16:17:18 -0600
Subject: [PATCH] Update how tokens are redacted

Using SHA-1 to match how Nova and Swift redact their tokens.
Was discussed in the below thread:

http://lists.openstack.org/pipermail/openstack-dev/2014-September/045802.html

Here's what nova went with: https://review.openstack.org/#/c/99511/
swift seem to be following suit: https://review.openstack.org/#/c/99632/

Change-Id: I3045d6d9d2a13770f4022dbbd474b34eb1032f6e
Closes-bug: 1329301
---
 glanceclient/common/http.py  |  9 +++------
 glanceclient/common/utils.py | 12 ++++++++++++
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/glanceclient/common/http.py b/glanceclient/common/http.py
index 8c7937a2..547bd7c0 100644
--- a/glanceclient/common/http.py
+++ b/glanceclient/common/http.py
@@ -36,6 +36,7 @@ if not hasattr(parse, 'parse_qsl'):
     parse.parse_qsl = cgi.parse_qsl
 
 from glanceclient.common import https
+from glanceclient.common.utils import safe_header
 from glanceclient import exc
 from glanceclient.openstack.common import importutils
 from glanceclient.openstack.common import network_utils
@@ -95,9 +96,7 @@ class HTTPClient(object):
         headers.update(self.session.headers)
 
         for (key, value) in six.iteritems(headers):
-            if key.lower() == 'x-auth-token':
-                value = '*' * 3
-            header = '-H \'%s: %s\'' % (key, value)
+            header = '-H \'%s: %s\'' % safe_header(key, value)
             curl.append(header)
 
         if not self.session.verify:
@@ -123,9 +122,7 @@ class HTTPClient(object):
         status = (resp.raw.version / 10.0, resp.status_code, resp.reason)
         dump = ['\nHTTP/%.1f %s %s' % status]
         headers = resp.headers.items()
-        if 'X-Auth-Token' in resp.headers:
-            headers['X-Auth-Token'] = '*' * 3
-        dump.extend(['%s: %s' % (k, v) for k, v in headers])
+        dump.extend(['%s: %s' % safe_header(k, v) for k, v in headers])
         dump.append('')
         if body:
             body = strutils.safe_decode(body)
diff --git a/glanceclient/common/utils.py b/glanceclient/common/utils.py
index d1a634ef..d40a704d 100644
--- a/glanceclient/common/utils.py
+++ b/glanceclient/common/utils.py
@@ -39,6 +39,8 @@ from glanceclient.openstack.common import strutils
 
 _memoized_property_lock = threading.Lock()
 
+SENSITIVE_HEADERS = ('X-Auth-Token', )
+
 
 # Decorator for cli-args
 def arg(*args, **kwargs):
@@ -385,3 +387,13 @@ def memoized_property(fn):
                     setattr(self, attr_name, fn(self))
             return getattr(self, attr_name)
     return _memoized_property
+
+
+def safe_header(name, value):
+    if name in SENSITIVE_HEADERS:
+        v = value.encode('utf-8')
+        h = hashlib.sha1(v)
+        d = h.hexdigest()
+        return name, "{SHA1}%s" % d
+    else:
+        return name, value