From 4ec4832bd81a1fba0542e4dc76f51401fc9ccd6f Mon Sep 17 00:00:00 2001
From: Aayush Atharva <aayush@shieldblaze.com>
Date: Sat, 25 Jul 2026 17:40:21 +0000
Subject: [PATCH] Trim dead sensitive-logging wrappers and document scope

---
 .../netty/handler/HttpMessageFormatter.java       | 15 +--------------
 .../netty/request/NettyRequest.java               |  3 +++
 .../util/SensitiveLoggingUtils.java               |  4 ++++
 3 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/client/src/main/java/org/asynchttpclient/netty/handler/HttpMessageFormatter.java b/client/src/main/java/org/asynchttpclient/netty/handler/HttpMessageFormatter.java
index 0c8e8596b..4ad8747ba 100644
--- a/client/src/main/java/org/asynchttpclient/netty/handler/HttpMessageFormatter.java
+++ b/client/src/main/java/org/asynchttpclient/netty/handler/HttpMessageFormatter.java
@@ -30,9 +30,6 @@
  */
 public final class HttpMessageFormatter {
 
-    /** The value used in place of sensitive header values. */
-    public static final String REDACTED = SensitiveLoggingUtils.REDACTED;
-
     private HttpMessageFormatter() {
     }
 
@@ -54,18 +51,8 @@ static String format(HttpResponse response) {
     private static StringBuilder appendHeaders(StringBuilder value, HttpHeaders headers) {
         for (Map.Entry<String, String> header : headers) {
             value.append('\n').append(header.getKey()).append(": ")
-                    .append(isSensitiveHeader(header.getKey()) ? REDACTED : header.getValue());
+                    .append(SensitiveLoggingUtils.isSensitiveHeader(header.getKey()) ? SensitiveLoggingUtils.REDACTED : header.getValue());
         }
         return value;
     }
-
-    /**
-     * Returns whether a header value must be redacted from logs.
-     *
-     * @param name the header name
-     * @return {@code true} for authentication and cookie headers when sensitive logging is disabled
-     */
-    public static boolean isSensitiveHeader(CharSequence name) {
-        return SensitiveLoggingUtils.isSensitiveHeader(name);
-    }
 }
diff --git a/client/src/main/java/org/asynchttpclient/netty/request/NettyRequest.java b/client/src/main/java/org/asynchttpclient/netty/request/NettyRequest.java
index 8a4951b0a..a030a4d29 100755
--- a/client/src/main/java/org/asynchttpclient/netty/request/NettyRequest.java
+++ b/client/src/main/java/org/asynchttpclient/netty/request/NettyRequest.java
@@ -21,6 +21,9 @@
 
 import java.util.concurrent.atomic.AtomicIntegerFieldUpdater;
 
+// Deliberately no toString() override: NettyResponseFuture#toString renders this object via
+// Object.toString() so debug logs never include the wrapped httpRequest's headers. Adding a
+// toString() here that exposes httpRequest would leak Authorization/Cookie values into logs.
 public final class NettyRequest {
 
     @SuppressWarnings("rawtypes")
diff --git a/client/src/main/java/org/asynchttpclient/util/SensitiveLoggingUtils.java b/client/src/main/java/org/asynchttpclient/util/SensitiveLoggingUtils.java
index 92be0c35f..c6b8ef7aa 100644
--- a/client/src/main/java/org/asynchttpclient/util/SensitiveLoggingUtils.java
+++ b/client/src/main/java/org/asynchttpclient/util/SensitiveLoggingUtils.java
@@ -23,6 +23,10 @@
  * Shared policy for rendering sensitive HTTP headers in logs. The policy is read once from the
  * {@code org.asynchttpclient.enableSensitiveLogging} system property or {@code AHC_ENABLE_SENSITIVE_LOGGING} environment
  * variable when this class is initialized.
+ * <p>
+ * Covers request credential headers only. {@code WWW-Authenticate} and {@code Proxy-Authenticate} response
+ * challenge headers are logged unredacted, and request form/query/multipart/body values are out of scope since
+ * they have no reliable generic sensitivity classification.
  */
 public final class SensitiveLoggingUtils {