Passwords show in Rails logs when lograge is enabled and custom options are provided #28
Comments
|
pull request: #29 |
|
What version of rails are you using? Passwords are being filtered out of
|
|
Rails 3.2.11 |
|
It looks like rails filters parameters before it sends them to instrumentation, not sure why passwords are showing up for you. |
|
Had the same issue... (Rails 4.0.1) payload[:params] = request.filtered_parameters |
|
Yep, I'm not sure what ten-months-ago-me was on about. |
danielpowell4
added a commit
to danielpowell4/lograge
that referenced
this issue
Jun 3, 2019
Good for this to be top of mind so no one traverses as such:
```
config.lograge.custom_payload do |controller|
exceptions = %w(controller action format authenticity_token)
{
params: controller.request.params.except(*exceptions), # request.params is DANGEROUS
}
end
```
request.filtered_params is at least a bit safer as noted in roidrage#28
danielpowell4
added a commit
to danielpowell4/lograge
that referenced
this issue
Jun 3, 2019
Good for this to be top of mind so no one traverses as such:
```
config.lograge.custom_payload do |controller|
exceptions = %w(controller action format authenticity_token)
{
params: controller.request.params.except(*exceptions), # request.params is DANGEROUS
}
end
```
request.filtered_parameters is at least a bit safer as noted
in roidrage#28
iloveitaly
pushed a commit
that referenced
this issue
Jan 20, 2022
Good for this to be top of mind so no one traverses as such:
```
config.lograge.custom_payload do |controller|
exceptions = %w(controller action format authenticity_token)
{
params: controller.request.params.except(*exceptions), # request.params is DANGEROUS
}
end
```
request.filtered_parameters is at least a bit safer as noted
in #28
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When using standard Rails logging, fields named password are filtered out before being logged. So they show up as
:password=>\"[FILTERED]\"When using lograge, this filtering doesn't happen - the param shows up as
"password"=>"hunter2"in the logs.Note: this doesn't happen by default, it only happens if you are passing parameters through using
append_info_to_payload.The text was updated successfully, but these errors were encountered: