From 070060b27ced1587d185081aefa32d05c0e0a778 Mon Sep 17 00:00:00 2001
From: Bunlong Heng <bunlong.heng@thryv.com>
Date: Wed, 5 Aug 2026 11:44:33 -0400
Subject: [PATCH] fix: expand SENSITIVE_HEADERS to cover proxy and gateway
 credential headers

---
 src/openai/_utils/_logs.py       | 10 +++++++++-
 tests/test_utils/test_logging.py | 23 +++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/src/openai/_utils/_logs.py b/src/openai/_utils/_logs.py
index eaffa5ec7a..8e8cfb8f3b 100644
--- a/src/openai/_utils/_logs.py
+++ b/src/openai/_utils/_logs.py
@@ -8,7 +8,15 @@
 httpx_logger: logging.Logger = logging.getLogger("httpx")
 
 
-SENSITIVE_HEADERS = {"api-key", "authorization", "x-amz-security-token"}
+SENSITIVE_HEADERS = {
+    "api-key",
+    "authorization",
+    "cookie",
+    "proxy-authorization",
+    "set-cookie",
+    "x-amz-security-token",
+    "x-api-key",
+}
 
 
 def _basic_config() -> None:
diff --git a/tests/test_utils/test_logging.py b/tests/test_utils/test_logging.py
index cc018012e2..d6d76269f7 100644
--- a/tests/test_utils/test_logging.py
+++ b/tests/test_utils/test_logging.py
@@ -94,6 +94,29 @@ def test_headers_without_sensitive_info(logger_with_filter: logging.Logger, capl
     )
 
 
+def test_proxy_credential_headers_redacted(logger_with_filter: logging.Logger, caplog: pytest.LogCaptureFixture) -> None:
+    with caplog.at_level(logging.DEBUG):
+        logger_with_filter.debug(
+            "Request options: %s",
+            {
+                "method": "post",
+                "url": "chat/completions",
+                "headers": {
+                    "x-api-key": "gateway-secret",
+                    "Proxy-Authorization": "Basic dXNlcjpwYXNz",
+                    "Cookie": "session=abc123",
+                    "Set-Cookie": "token=xyz",
+                },
+            },
+        )
+
+    log_record = cast(Dict[str, Any], caplog.records[0].args)
+    assert log_record["headers"]["x-api-key"] == "<redacted>"
+    assert log_record["headers"]["Proxy-Authorization"] == "<redacted>"
+    assert log_record["headers"]["Cookie"] == "<redacted>"
+    assert log_record["headers"]["Set-Cookie"] == "<redacted>"
+
+
 def test_standard_debug_msg(logger_with_filter: logging.Logger, caplog: pytest.LogCaptureFixture) -> None:
     with caplog.at_level(logging.DEBUG):
         logger_with_filter.debug("Sending HTTP Request: %s %s", "POST", "chat/completions")