What can PHP-VCR users do to prevent passwords being saved?

[RichardBradley]

My API passwords are being saved to the "cassette" files by PHP-VCR.
This is a big problem for me, as I'd like to use PHP-VCR to help automate my tests, but I don't want to commit my API passwords to my source control.

The PHP-VCR website says:

Soon: Privacy aware
Automatically filters confidential or private information like emails, tokens and passwords.

... but I can't see an open issue tracking the implementation of this feature.

1. What options do I have in the current version for dealing with this issue?
2. Is there a more specific timetable than "soon" for the feature promised on that documentation page?

Thanks

[renatomefi]

@RichardBradley thanks for you concern about it.

Currently there is no PR opened for it, the specific time for new feature comes after we clean all current issues and opened PR's.

Of course you can open a PR to fix that for us and then I'll gladly check it! Are you willing to do this?

I you want you can make some kind of encryption on the files and decrypt them in the CI environment, but it won't make the tests run the same for the other developers.
Or
If you remove manually the API passwords from the files should work, right?

I can also imagine you have some kind of shared API keys between the team members in the project? Like a test API or some other way to allow people to develop into it.

Those are the things I can think now, I hope you can find a way!

[MrRio]

A nice way to do it might be to "scrub" any variables from requests that are found in .env and replace them with references to that

[adri]

One way is to add listener for the VCREvents::VCR_BEFORE_RECORD event.

VCR::getEventDispatcher()->addListener(VCREvents::VCR_BEFORE_RECORD, array($this, 'cleanRequest'));

The BeforeRecord event contains the

• Request
• Response and
• Cassette.

public function cleanRequest(Event $event, $eventName)
{
    $request = $event->getRequest();
    // Do something with the request, like remove headers
}

Hope this helps.

[allejo]

Here's a quick and dirty solution that works for my use cases.

https://github.com/allejo/php-vcr-sanitizer

[aksonnic]

For anyone searching for this, I've got a PR #344 submitted. Reviews/comments welcome.