fix(security): redact sensitive headers from debug logs

[giulio-leone]

Summary

Fixes #1196

Response headers were logged unfiltered at debug level in both sync and async HTTP clients (_base_client.py), potentially exposing authorization and api-key header values in log output.

Changes

• src/openai/_base_client.py: Filter response.headers through a dict comprehension that redacts values for headers in SENSITIVE_HEADERS before logging. Applied to both SyncAPIClient and AsyncAPIClient.
• src/openai/_utils/__init__.py: Export the existing SENSITIVE_HEADERS set from _logs.py so it can be reused in _base_client.py.
• tests/test_utils/test_logging.py: Added test verifying response header redaction logic.

Approach

Reuses the existing SENSITIVE_HEADERS set ({"api-key", "authorization"}) from _utils/_logs.py, which is already used by SensitiveHeadersFilter for request options. The filter only needed to cover request args in dict format; this PR extends coverage to response headers logged directly.

Before

DEBUG HTTP Response: POST https://api.openai.com/v1/chat/completions "200 OK" Headers({"authorization": "Bearer sk-...", ...})

After

DEBUG HTTP Response: POST https://api.openai.com/v1/chat/completions "200 OK" {"authorization": "<redacted>", ...}

[Copilot]

Pull request overview

This PR addresses #1196 by preventing sensitive response headers (e.g., authorization, api-key) from being emitted in debug logs in the sync and async HTTP clients.

Changes:

• Redacts sensitive values when logging httpx.Response.headers in both SyncAPIClient and AsyncAPIClient.
• Re-exports SENSITIVE_HEADERS from openai._utils to reuse the existing sensitive-header allowlist.
• Adds a test intended to validate the response-header redaction logic.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/openai/_base_client.py	Redacts sensitive response headers before emitting debug logs for HTTP responses.
src/openai/_utils/__init__.py	Exposes SENSITIVE_HEADERS for reuse outside _utils/_logs.py.
tests/test_utils/test_logging.py	Adds a test for header redaction behavior using SENSITIVE_HEADERS.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[giulio-leone]

Intervention note for this PR:

Current blocker appears to be missing CI execution rather than failing jobs:

• No checks reported on this branch.

Suggested unblock sequence:

1. Trigger CI workflows for this PR (or confirm why workflows are not attached for this branch/fork).
2. Once checks appear, fix any failing jobs and re-run.
3. Request review only after a green check suite is visible.

If useful, I can run a follow-up status sweep as soon as checks are attached.

[giulio-leone]

Friendly follow-up — this addresses a security concern (#1196) where sensitive headers could be exposed in debug logs. The fix is minimal (2 files) and all existing tests pass. Would appreciate a review when you get a chance. 🙏

[giulio-leone]

This PR is ready for review — all CI checks pass, no merge conflicts, and all review threads have been resolved. Ready to merge when approved. 🚀

[giulio-leone]

Hi! 👋 Gentle ping — this PR is rebased, CI passes, and ready for review. Happy to address any feedback. Thanks!