Forum: Ruby on Rails Hide password params in log file

Announcement (2017-05-07): www.ruby-forum.com is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see rubyonrails.org/community and ruby-lang.org/en/community for other Rails- und Ruby-related community platforms.
Fernando P. (Guest)
on 2009-02-23 18:38
Hi,

I just noticed that when users register or login to my website (I use
restful_auth), their password gets printed out in the production.log
file. How can I prevent that? I consider this a major security issue.

SSL is used to prevent eavesdropping and passwords are stored encrypted
in DB by the way, but I never thought about log files.
Charles J. (Guest)
on 2009-02-23 19:04
(Received via mailing list)
On Mon, Feb 23, 2009 at 10:38 AM, Fernando P. <
removed_email_address@domain.invalid> wrote:

>
> Hi,
>
> I just noticed that when users register or login to my website (I use
> restful_auth), their password gets printed out in the production.log
> file. How can I prevent that? I consider this a major security issue.
>
> SSL is used to prevent eavesdropping and passwords are stored encrypted
> in DB by the way, but I never thought about log files.


In you application.rb file use

filter_parameter_logging "password"

HTH

Charles
Conrad T. (Guest)
on 2009-02-23 19:05
(Received via mailing list)
On Mon, Feb 23, 2009 at 8:38 AM, Fernando P. <
removed_email_address@domain.invalid> wrote:

>
> Hi,
>
> I just noticed that when users register or login to my website (I use
> restful_auth), their password gets printed out in the production.log
> file. How can I prevent that? I consider this a major security issue.
>
> SSL is used to prevent eavesdropping and passwords are stored encrypted
> in DB by the way, but I never thought about log files.


Hi, please remember google is your friend:

a)  Google is your friend


http://www.google.com/search?hl=en&rlz=1G1GGLQ_ENU...

b)  Api Documents is also a good resource

     http://api.rubyonrails.org

     Note:  If you search for password, you'll also find a reference for
'
filter_parameter_logging'

Good luck,

-Conrad
Robby R. (Guest)
on 2009-02-23 19:07
(Received via mailing list)
Fernando,

filter_parameter_logging is your friend.

*
http://robbyonrails.com/articles/2007/07/16/rails-...

Cheers,
Robby

On Mon, Feb 23, 2009 at 8:38 AM, Fernando P.
<removed_email_address@domain.invalid> wrote:
> Posted via http://www.ruby-forum.com/.
>
> >
>



--
Robby R.
Chief Evangelist, Partner

PLANET ARGON, LLC
design // development // hosting w/Ruby on Rails

http://planetargon.com/
http://robbyonrails.com/
http://twitter.com/planetargon
aim: planetargon

+1 503 445 2457
+1 877 55 ARGON [toll free]
+1 815 642 4068 [fax]
Gregory M. (Guest)
on 2009-02-23 19:15
(Received via mailing list)
in application.rb, insert: filter_parameter_logging "password"

On Mon, Feb 23, 2009 at 11:38 AM, Fernando P. <
Fernando P. (Guest)
on 2009-02-23 19:58
> in application.rb, insert: filter_parameter_logging "password"

Thank you all for your replies. This should be included by default (or
at least commented out?) in restful_auth generator and any other
authentication plugin.
Robby R. (Guest)
on 2009-02-24 04:54
(Received via mailing list)
Pretty sure this is in there by default in recent versions of Rails.
(in application controller) (2.3 i believe)

On Mon, Feb 23, 2009 at 9:58 AM, Fernando P.
<removed_email_address@domain.invalid> wrote:
> >
>



--
Robby R.
Chief Evangelist, Partner

PLANET ARGON, LLC
design // development // hosting w/Ruby on Rails

http://planetargon.com/
http://robbyonrails.com/
http://twitter.com/planetargon
aim: planetargon

+1 503 445 2457
+1 877 55 ARGON [toll free]
+1 815 642 4068 [fax]
This topic is locked and can not be replied to.