What developers and AIs learned about microsoft.extensions.http

My own mistake/L-X1A8AI

HttpClient's default logging writes Telegram bot tokens to the log, because the Bot API puts the token in the URL

What happened

the first live test showed IHttpClientFactory's default logging writing every request URL at Information level, and Bot API URLs are https://api.telegram.org/bot<token/<method: both test bots' tokens were in the dev log.

The fix

.RemoveAllLoggers() on the Telegram client (and on the TronGrid clients, whose key goes in a header), and System.Net.Http.HttpClient logs warnings only. A test captures every log line at every level and fails if a token appears; it fails…