Check sensitive fields case-insensitive

config/request-response-log.php

@@ -6,7 +6,7 @@
     'prune_after_days' => 30,
 
     'security' => [
-        // For security reason we should not log sensitive fields.
+        // For security reason we should not log sensitive fields. These fields will be checked case-insensitive.
         'sensitive_fields' => [
             'password',
             'access_token',
@@ -22,6 +22,8 @@
             'php-auth-digest',
         ],
 
+        // For security reason we should not log sensitive fields for certain vendors. These fields will be checked
+        // case-insensitive.
         'sensitive_fields_per_vendor' => [],
     ],
 

src/Helpers/Sanitizer.php

@@ -3,6 +3,7 @@
 namespace Goedemiddag\RequestResponseLog\Helpers;
 
 use Illuminate\Support\Arr;
+use Illuminate\Support\Str;
 use JsonException;
 
 class Sanitizer
@@ -41,8 +42,10 @@ public static function filterSensitiveData(array $array = [], ?string $vendor =
         $sensitiveFieldsPerVendor = Arr::get(config('request-response-log.security.sensitive_fields_per_vendor', []), $vendor, []);
 
         foreach ($array as $key => $value) {
-            $hasGenericSensitiveKey = in_array($key, $sensitiveFields, true);
-            $hasVendorSensitiveKey = in_array($key, $sensitiveFieldsPerVendor, true);
+            $searchKey = Str::lower($key);
+
+            $hasGenericSensitiveKey = in_array($searchKey, $sensitiveFields, true);
+            $hasVendorSensitiveKey = in_array($searchKey, $sensitiveFieldsPerVendor, true);
 
             // When the key is sensitive, mask the value
             if ($hasGenericSensitiveKey || $hasVendorSensitiveKey) {

tests/Helpers/SanitizerTest.php

@@ -12,13 +12,16 @@ public function test_it_filters_sensitive_data(): void
         $data = [
             'password' => 'secret',
             'hello' => 'world',
+            'Authorization' => 'Bearer my-secret-key',
         ];
 
         $sanitizedData = Sanitizer::filterSensitiveData($data);
 
         $this->assertArrayHasKey('password', $sanitizedData);
         $this->assertArrayHasKey('hello', $sanitizedData);
+        $this->assertArrayHasKey('Authorization', $sanitizedData);
         $this->assertSame('********', $sanitizedData['password']);
+        $this->assertSame('********', $sanitizedData['Authorization']);
         $this->assertSame('world', $sanitizedData['hello']);
     }