Related: #92337. When tracing REST requests with APM, we capture HTTP headers as labels on the trace, but redact sensitive values. However, we can't know ahead of time what are all possible sensitive values. It would be better if it was possible to configure additional patterns to redact.
server/src/main/java/org/elasticsearch/rest/RestController.java
final String value = switch (lowerKey) {
                case "authorization", "cookie", "secret", "session", "set_cookie", "token", "x_elastic_app_auth" -> "[REDACTED]";
                default -> String.join("; ", values);
            };
            attributes.put("http.request.headers." + lowerKey, value);
        });
        attributes.put("http.method", method);
        attributes.put("http.url", req.uri());
        switch (req.getHttpRequest().protocolVersion()) {
            case HTTP_1_0 -> attributes.put("http.flavour", "1.0");
            case HTTP_1_1 -> attributes.put("http.flavour", "1.1");
        }
        tracer.startTrace(threadContext, "rest-" + channel.request().getRequestId(), name, attributes);
    }
    private void traceException(RestChannel channel, Throwable e) {
        this.tracer.addError("rest-" + channel.request().getRequestId(), e);
    }
    private static void sendContentTypeErrorMessage(@Nullable List<String> contentTypeHeader, RestChannel channel) throws IOException {
        final String errorMessage;
        if (contentTypeHeader == null) {
            errorMessage = "Content-Type header is missing";
        } else {
            errorMessage = "Content-Type header [" + Strings.collectionToCommaDelimitedString(contentTypeHeader) + "] is not supported";
        }
        channel.sendResponse(RestResponse.createSimpleErrorResponse(channel, NOT_ACCEPTABLE, errorMessage));
    }
    private void tryAllHandlers(final RestRequest request, final RestChannel channel, final ThreadContext threadContext) throws Exception {
        try {
            copyRestHeaders(request, threadContext);
            validateErrorTrace(request, channel);