# Keeping passwords and other sensitive data out of the logs **URL:** \ **Category:** Rails\ **Created:** [August 16, 2006, 12:52am UTC](https://www.ruby-forum.com/t/keeping-passwords-and-other-sensitive-data-out-of-the-logs/65082 "2006-08-16T00:52:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![squeegy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/dec6dc/32.png) [@squeegy](https://www.ruby-forum.com/u/squeegy)\ **Post date:** [August 16, 2006, 12:52am UTC](https://www.ruby-forum.com/t/keeping-passwords-and-other-sensitive-data-out-of-the-logs/65082/1 "2006-08-16T00:52:31Z")
Even is production mode Rails logs all requests params in the log files. The problem is this often includes things like user passwords, credit card numbers and other data. It even displays them when the values are POSTed. If my server is hacked it would be easy to pick this data out of the logs by a regex or two. Is is possible to prevent logging certain params? This seems like it could be a troublesome security hole. Any tips? ---
**Author:** ![squeegy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/dec6dc/32.png) [@squeegy](https://www.ruby-forum.com/u/squeegy)\ **Post date:** [August 16, 2006, 1:01am UTC](https://www.ruby-forum.com/t/keeping-passwords-and-other-sensitive-data-out-of-the-logs/65082/2 "2006-08-16T01:01:05Z")
On Aug 15, 2006, at 3:52 PM, Alex W. wrote: > Any tips? > > – > Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/). > > * * * > > Rails mailing list > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) In edge rails there is a filter\_log\_params functionality that will filter certain things that you specify out of the log file. If you are not on edge I think there is a plugin somewhere called filtered\_log\_params that you can use. -Ezra ---
**Author:** ![squeegy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/dec6dc/32.png) [@squeegy](https://www.ruby-forum.com/u/squeegy)\ **Post date:** [August 16, 2006, 2:32am UTC](https://www.ruby-forum.com/t/keeping-passwords-and-other-sensitive-data-out-of-the-logs/65082/3 "2006-08-16T02:32:31Z")
Ezra Z. wrote: > In edge rails there is a filter\_log\_params functionality that will > filter certain things that you specify out of the log file. If you > are not on edge I think there is a plugin somewhere called > filtered\_log\_params that you can use. > > -Ezra Ah thanks, I’m on edge so I’ll see if that works. ---
**Author:** ![squeegy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/dec6dc/32.png) [@squeegy](https://www.ruby-forum.com/u/squeegy)\ **Post date:** [August 16, 2006, 3:46am UTC](https://www.ruby-forum.com/t/keeping-passwords-and-other-sensitive-data-out-of-the-logs/65082/4 "2006-08-16T03:46:28Z")
Alex W. wrote: > Ezra Z. wrote: > > > In edge rails there is a filter\_log\_params functionality that will > > filter certain things that you specify out of the log file. If you > > are not on edge I think there is a plugin somewhere called > > filtered\_log\_params that you can use. > > > > -Ezra > > Ah thanks, I’m on edge so I’ll see if that works. I cant seem to find any reference to that on the edge docs or in the edge source. And the plugin svn seems to be down svn://suven.no-ip.org/rails/plugins/filter\_logged\_params How do I use the edge implementation? ---
**Author:** ![squeegy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/dec6dc/32.png) [@squeegy](https://www.ruby-forum.com/u/squeegy)\ **Post date:** [August 16, 2006, 3:49am UTC](https://www.ruby-forum.com/t/keeping-passwords-and-other-sensitive-data-out-of-the-logs/65082/5 "2006-08-16T03:49:13Z")
Guest wrote: > Alex W. wrote: > > > Ezra Z. wrote: > > > > > In edge rails there is a filter\_log\_params functionality that will > > > filter certain things that you specify out of the log file. If you > > > are not on edge I think there is a plugin somewhere called > > > filtered\_log\_params that you can use. > > > > > > -Ezra > > > > Ah thanks, I’m on edge so I’ll see if that works. > > I cant seem to find any reference to that on the edge docs or in the > edge source. And the plugin svn seems to be down > > svn://suven.no-ip.org/rails/plugins/filter\_logged\_params > > How do I use the edge implementation? Nevermind… It’s filter\_paramerter\_logging [http://api.rubyonrails.com/classes/ActionController/Base.html#M000201](http://api.rubyonrails.com/classes/ActionController/Base.html#M000201)