You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Make HeaderValue::set_sensitive available in const contexts #807
Hey, I'd like to use HeaderValue::set_sensitive when defining header value constants with HeaderValue::from_static.
In particular, I'd like to mark an OAuth client credential that's compiled into the application as sensitive.
I fully understand that a value that's compiled into the binary is trivial to dump and shouldn't be considered secure. Moreover, I fully understand that no amount of obfuscation will change this. However, many OAuth implementations (like GitHub or Forgejo) always issue client credentials, regardless of whether the client is public or confidential. This means clients are forced to use the credential, which effectively means the credential has to be embedded into the client.
I'd be willing to contribute a PR for this, but I wanted to open an issue to discuss first, as the idea of storing confidential header values as constants seems controversial. In addition to the const keyword, a note in the doc comment to discourage developers from embedding secrets might be warranted.
Activity
seanmonstar commentedon Dec 18, 2025
That seems like fair change. Would you like to submit a PR?
feat(header): make HeaderValue::set_sensitive const
archer-321 commentedon Dec 19, 2025
Thanks for the reply!
I've opened #808. Please let me know if you'd like to see any changes 🙂
feat(header): make HeaderValue::set_sensitive const