[kmcginnes]

Summary

Two follow-ups from Rank the database policy over the origin allowlist (#2493): the error handler's request-header log line now gets the same control-character escaping as client logs, and the origin allowlist gets test coverage for signed requests.

User-facing: none

 errorHandlingMiddleware
   logger.error("Request headers: %s",
-    allowlisted headers → redactUrlCredentials
+    escapeControlCharacters(allowlisted headers → redactUrlCredentials)
   )

• Reuses escapeControlCharacters from logging.ts, added in Escape DEL and C1 control characters in client logs (#2488). Escaping runs after URL credential redaction, so redaction output is unchanged.
• New test: with PROXY_SERVER_ALLOWED_DB_ORIGINS set, a signed request (aws-neptune-region + service-type) to an origin outside the list returns 403 on every forwarding route, names the allowlist in the error, and fetches nothing.

Evidence

Before: a DEL or C1 character in an allowlisted header value was written to the header log line as-is.
After: new tests pass, and each fails with its change removed:

• error-handler.test.ts › escapes DEL and C1 control characters in a header value
• app.test.ts › escapes a C1 control character in a logged header value (through the real HTTP server)
• app.test.ts › $method $route returns 403 for a signed request without fetching the disallowed origin

Verified live: ran the app on loopback with a header value containing a C1 character; the log line showed it as \u0085, and URL credentials stayed redacted.

Merge Danger

Door: two-way

Impact: logging

Only the format of the error-path header log line changes. Responses are unchanged.

---

_{🤖 Written by an AI agent on my behalf.}

[kmcginnes]

Approved