Allow configuring shouldLogRequestHeader/shouldLogResponseHeader

[jkstrauss]

**Suppressing specific headers is cumbersome **
Certain headers should probably not be logged, e.g., Authorization.

Add configuration properties to include/exclude headers
Add the following list configurations:

• spring.cloud.openfeign.client.config.name.headers.request.include
• spring.cloud.openfeign.client.config.name.headers.request.exclude
• spring.cloud.openfeign.client.config.name.headers.response.include
• spring.cloud.openfeign.client.config.name.headers.response.exclude

The expected behavior would be to exclude any header in the exclude list, and only show header in the include list if any are present.

Alternatives: Making a custom component

@Component
    class MyFeignLoggerFactory implements FeignLoggerFactory {
      @Override
      public Logger create(Class<?> type) {
        return new Slf4jLogger(type) {
          @Override
          protected boolean shouldLogRequestHeader(String header) {
            return !"Authorization".equals(header);
          }
        };
      }
    }

[PRAHLAD09-dev]

Thanks for filing this — the pain point is real and the scope is nicely self-contained, which fits well given this project only takes small, additive community PRs at this point.

A few thoughts before diving into implementation:

Simplify the property surface. The primary use case here is hiding sensitive headers (Authorization, tokens, etc.), not selective allow-listing. A single exclude-only list — spring.cloud.openfeign.client.config..logging.sensitive-headers — would cover that need without the precedence ambiguity an include+exclude combo introduces (what happens if a header is in both lists? does include override a global exclude?). If there's a concrete use case for include-lists too, happy to hear it, but I'd start minimal and extend later if needed.

Implementation sketch. This would plug in similarly to how default-request-headers is already resolved per client in FeignClientProperties — a custom Logger/FeignLoggerFactory extending Slf4jLogger, overriding shouldLogRequestHeader/shouldLogResponseHeader, populated from the resolved config instead of requiring a hand-rolled bean.

One caveat worth documenting. Even with header suppression in place, FULL logging mode can still leak header-like data embedded in the raw request/response body dump (see OpenFeign/feign#2586). Worth calling that out in the docs so this doesn't get treated as a complete guarantee.

Happy to put together a PR once there's agreement on exclude-only vs. include+exclude — let me know which direction you'd prefer.

[jkstrauss]

@PRAHLAD09-dev I like your simplified solution. Just have sensitive-headers list.