# How to obscure/encrypt password parameter?

**URL:** <https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788>\
**Category:** Rails\
**Created:** [July 10, 2006, 4:40pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788 "2006-07-10T16:40:57Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [July 10, 2006, 4:40pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788/1 "2006-07-10T16:40:57Z")

</div>

Hi all-

I am building an application that includes a login screen. During  
development I found that user passwords are logged by Rails in plain  
text – this will not be acceptable to my users. Is there a way to  
obscure/encrypt incoming password parameters or not write them to the  
log files at all? One thought was to use Javascript, but I was not sure  
how secure that would be.

Thanks,  
Josh

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [July 10, 2006, 5:05pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788/2 "2006-07-10T17:05:57Z")

</div>

> From the Rails WIKI

[http://wiki.rubyonrails.com/rails/pages/HowtoAuthenticate](http://wiki.rubyonrails.com/rails/pages/HowtoAuthenticate)

Q: Don’t plain-text passwords still show up in the access log files as  
part  
of the POST requests? Anyone know how to prevent that?

A: Yes, post data shows up in log files including passwords. To prevent  
this  
adjust your logging level:

RAILS\_DEFAULT\_LOGGER.level = Logger::WARN

A: I also ran into this problem. Rather than just change the log level  
everywhere, I wanted to only increase it around controller actions that  
dealt with passwords. Additionally, the default logging level for  
development is Logger::DEBUG, but for production it’s Logger::INFO.

So what I did was add two methods to my login controller:  
def upgrade\_logging RAILS\_DEFAULT\_LOGGER.level = Logger::WARN end def  
restore\_logging if ENV[‘RAILS\_ENV’] == “production”  
RAILS\_DEFAULT\_LOGGER.level = Logger::INFO elsif ENV[‘RAILS\_ENV’] ==  
“development” RAILS\_DEFAULT\_LOGGER.level = Logger::DEBUG end end

and then setup before\_filters to call them around my sensitive actions:  
before\_filter :upgrade\_logging,  
:except=\>[:home\_page,:logout,:list\_users,:delete\_user] before\_filter  
:restore\_logging,  
:except=\>[:add\_user,:login,:change\_password,:reset\_password]

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [July 10, 2006, 5:16pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788/3 "2006-07-10T17:16:03Z")

</div>

If you still want to see other request parameters but not passwords,  
check  
out this patch:

[http://dev.rubyonrails.org/ticket/1897](http://dev.rubyonrails.org/ticket/1897)

I noticed this is already applied to the HEAD, so check out edge rails  
if  
you don’t want to do the work yourself.

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [July 10, 2006, 5:38pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788/4 "2006-07-10T17:38:30Z")

</div>

Thanks for the information, but the latter suggestion would not seem to  
work. Logging of parameters is done by Rails code that is executed  
before it reaches my application code (e.g. prior to the before\_filter  
being called), so the parameters still appear in the log. The first  
method below eliminates the logging of some valuable information.

Although I would prefer not to need to modify the Rails source code, it  
seems that the second response to my posting would be the most  
preferable.

Thanks!

Brian H. wrote:

> > From the Rails WIKI
> 
> [Peak Obsession](http://wiki.rubyonrails.com/rails/pages/HowtoAuthenticate)
> 
> Q: Don’t plain-text passwords still show up in the access log files as  
> part  
> of the POST requests? Anyone know how to prevent that?
> 
> A: Yes, post data shows up in log files including passwords. To prevent  
> this  
> adjust your logging level:
> 
> RAILS\_DEFAULT\_LOGGER.level = Logger::WARN
> 
> A: I also ran into this problem. Rather than just change the log level  
> everywhere, I wanted to only increase it around controller actions that  
> dealt with passwords. Additionally, the default logging level for  
> development is Logger::DEBUG, but for production it’s Logger::INFO.
> 
> So what I did was add two methods to my login controller:  
> def upgrade\_logging RAILS\_DEFAULT\_LOGGER.level = Logger::WARN end def  
> restore\_logging if ENV[‘RAILS\_ENV’] == “production”  
> RAILS\_DEFAULT\_LOGGER.level = Logger::INFO elsif ENV[‘RAILS\_ENV’] ==  
> “development” RAILS\_DEFAULT\_LOGGER.level = Logger::DEBUG end end
> 
> and then setup before\_filters to call them around my sensitive actions:  
> before\_filter :upgrade\_logging,  
> :except=\>[:home\_page,:logout,:list\_users,:delete\_user] before\_filter  
> :restore\_logging,  
> :except=\>[:add\_user,:login,:change\_password,:reset\_password]

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [July 10, 2006, 6:04pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788/5 "2006-07-10T18:04:18Z")

</div>

Don’t mean to be a pest, but the patch[1] and corresponding changeset  
4200[2] address your specific problem from the core api. If the other  
suggestion works for you, great but I don’t want you to have incorrect  
information.

[1] [http://dev.rubyonrails.org/ticket/1897](http://dev.rubyonrails.org/ticket/1897)  
[2] [http://dev.rubyonrails.org/changeset/4200](http://dev.rubyonrails.org/changeset/4200)

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [July 10, 2006, 6:41pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788/6 "2006-07-10T18:41:44Z")

</div>

I was actually just looking at that changeset. At first it seemed that  
the change should be in the latest version of Rails (1.1.4), but per  
this note on the blog, it will not be included until v1.2:

* * *

> **[Rails 1.1.2: Tiny fix for gems dependencies](https://rubyonrails.org/2006/4/9/rails-1-1-2-tiny-fix-for-gems-dependencies)**
>
> The new gem version dependency system from Rails 1.1.1 needed a few tweaks to work properly and to stop throwing meaningless warnings. This tiny release makes up for that. To install:gem install railsrake rails:update:configs (to get the latest...

## filter\_parameter\_logging is a new feature, thus its slated for 1.2.0. New releases in the Rails 1.1.x line will only contain bug fixes.

Benjamin – is there another way to get the plugin? I have not been  
able to reach the subversion server listed in the link you provided  
above.

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [July 10, 2006, 6:44pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788/7 "2006-07-10T18:44:32Z")

</div>

Nevermind, I was able to find the plugin at  
[http://suven.no-ip.org/filter\_logged\_params.tar.gz](http://suven.no-ip.org/filter_logged_params.tar.gz).

-Josh

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [July 10, 2006, 6:04pm UTC](https://www.ruby-forum.com/t/how-to-obscure-encrypt-password-parameter/97788/8 "2006-07-10T18:04:44Z")

</div>

There is also the plugin version ([http://agilewebdevelopment.com/](http://agilewebdevelopment.com/)  
plugins/filter\_logged\_params) for older version of Rails.

–  
Benjamin C.  
[http://www.bencurtis.com/](http://www.bencurtis.com/)  
[http://www.tesly.com/](http://www.tesly.com/) – Collaborative test case management  
[http://www.agilewebdevelopment.com/](http://www.agilewebdevelopment.com/) – Resources for the Rails community