[Security] Redact cookies in sanitized headers output

.changeset/security-redact-cookies-in-logs.md

@@ -0,0 +1,5 @@
+---
+'@shopify/cli-kit': patch
+---
+
+Redact Cookie and Set-Cookie headers from debug logs to prevent sensitive session data leakage.

packages/cli-kit/src/private/node/api/headers.test.ts

@@ -97,6 +97,25 @@ describe('common API methods', () => {
        - Content-Type: application/json"
     `)
   })
+
+  test('sanitizedHeadersOutput removes the headers that include cookies', () => {
+    // Given
+    const headers = {
+      'User-Agent': 'useragent',
+      Cookie: 'session=abc',
+      'Set-Cookie': 'session=def',
+      'content-type': 'application/json',
+    }
+
+    // When
+    const got = sanitizedHeadersOutput(headers)
+
+    // Then
+    expect(got).toMatchInlineSnapshot(`
+      " - User-Agent: useragent
+       - content-type: application/json"
+    `)
+  })
 })
 
 describe('GraphQLClientError', () => {

packages/cli-kit/src/private/node/api/headers.ts

@@ -33,7 +33,7 @@ export class GraphQLClientError extends RequestClientError {
  */
 export function sanitizedHeadersOutput(headers: Record<string, string>): string {
   const sanitized: Record<string, string> = {}
-  const keywords = ['token', 'authorization', 'subject_token']
+  const keywords = ['token', 'authorization', 'subject_token', 'cookie']
   Object.keys(headers).forEach((header) => {
     if (keywords.find((keyword) => header.toLocaleLowerCase().includes(keyword)) === undefined) {
       sanitized[header] = headers[header]!