From 6d0fd3be8327f2100e7695b31150d735f91fc4e8 Mon Sep 17 00:00:00 2001 From: hugocasa Date: Mon, 12 Oct 2026 09:47:40 +0200 Subject: [PATCH] fix: keep resolved mcp secrets out of header warnings and userinfo urls Co-Authored-By: Claude Opus 5.5 --- backend/windmill-mcp/src/client/mod.rs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/backend/windmill-mcp/src/client/mod.rs b/backend/windmill-mcp/src/client/mod.rs index 5560b6e1c8..6f2c37f1b6 100644 --- a/backend/windmill-mcp/src/client/mod.rs +++ b/backend/windmill-mcp/src/client/mod.rs @@ -66,7 +66,11 @@ impl McpClient { ) })?; - let parsed_url = reqwest::Url::parse(&resource.url).context("Invalid MCP server URL")?; + let mut parsed_url = + reqwest::Url::parse(&resource.url).context("Invalid MCP server URL")?; + // reqwest moves userinfo to a header, so its errors print the URL without it. + let _ = parsed_url.set_username(""); + let _ = parsed_url.set_password(None); let server_url = ServerUrl { full: parsed_url.to_string(), origin: parsed_url.origin().ascii_serialization(), @@ -90,7 +94,8 @@ impl McpClient { headers.insert(name, value); } _ => { - tracing::warn!("Invalid header: {}={}", key, value); + // The value may be a resolved secret: name the header only. + tracing::warn!("Invalid header: {}", key); } } }