# Plain text passwords displayed in production.log

**URL:** <https://www.ruby-forum.com/t/plain-text-passwords-displayed-in-production-log/72985>\
**Category:** Rails\
**Created:** [February 24, 2006, 8:14pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-displayed-in-production-log/72985 "2006-02-24T20:14:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kenfc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b782af/32.png) [@kenfc](https://www.ruby-forum.com/u/kenfc)\
**Post date:** [February 24, 2006, 8:14pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-displayed-in-production-log/72985/1 "2006-02-24T20:14:43Z")

</div>

By default, all the paramaters are displayed in the production.log on a  
POST.

Unfortunately, this includes all the plain-text passwords that people  
type  
into the login form on my application, which is a huge security risk.  
I’m  
using a custom evaluation system that hooks into LDAP (not any of the  
generators/plugins).

View code is simple:  
\<%= text\_field ‘employee’, ‘login’, :size =\> 20 %\>  
…  
\<%= password\_field ‘employee’, ‘password’, :size =\> 20 %\>

Any ideas on how to stop the passwords from being logged when the login  
page  
is submitted?

Thanks,

Ken

---

<div class="post-metadata">

**Author:** ![kenfc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b782af/32.png) [@kenfc](https://www.ruby-forum.com/u/kenfc)\
**Post date:** [February 24, 2006, 8:35pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-displayed-in-production-log/72985/2 "2006-02-24T20:35:51Z")

</div>

Yes… read the docs on the logger… in production/environment.rb you  
can  
set the output level of your logger. I don’t remember it offhand though.

---

<div class="post-metadata">

**Author:** ![kenfc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b782af/32.png) [@kenfc](https://www.ruby-forum.com/u/kenfc)\
**Post date:** [February 24, 2006, 10:24pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-displayed-in-production-log/72985/3 "2006-02-24T22:24:58Z")

</div>

On 2/24/06, Ken P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Any ideas on how to stop the passwords from being logged when the login page  
> is submitted?

Try the Filter Logged Parameters plugin:  
[http://wiki.rubyonrails.org/rails/pages/Filter+Logged+Params+Plugin](http://wiki.rubyonrails.org/rails/pages/Filter+Logged+Params+Plugin)

---

<div class="post-metadata">

**Author:** ![kenfc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b782af/32.png) [@kenfc](https://www.ruby-forum.com/u/kenfc)\
**Post date:** [February 24, 2006, 11:04pm UTC](https://www.ruby-forum.com/t/plain-text-passwords-displayed-in-production-log/72985/4 "2006-02-24T23:04:14Z")

</div>

In your environment.rb inside the config block you need to uncomment  
and set your log level like this:

```
config.log_level = :warn

```

Cheers-  
-Ezra

On Feb 24, 2006, at 11:34 AM, Brian H. wrote:

> risk. I’m  
> is submitted?
> 
> * * *
> 
> Rails mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

-Ezra Z.  
Yakima Herald-Republic  
WebMaster

> **[yakimaherald.com | Yakima, Washington - We Tell Your Stories](https://www.yakimaherald.com/)**

509-577-7732  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![kenfc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b782af/32.png) [@kenfc](https://www.ruby-forum.com/u/kenfc)\
**Post date:** [February 25, 2006, 12:04am UTC](https://www.ruby-forum.com/t/plain-text-passwords-displayed-in-production-log/72985/5 "2006-02-25T00:04:43Z")

</div>

Thanks Ezra. Although I’d still like the transaction log, that will do  
until I  
have time to test out the Plugin that Jeremy suggested.

-Ken

---

<div class="post-metadata">

**Author:** ![kenfc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b782af/32.png) [@kenfc](https://www.ruby-forum.com/u/kenfc)\
**Post date:** [February 25, 2006, 3:27am UTC](https://www.ruby-forum.com/t/plain-text-passwords-displayed-in-production-log/72985/6 "2006-02-25T03:27:02Z")

</div>

How about, in your controller:

def login  
RAILS\_DEFAULT\_LOGGER.info “Attempting to authenticate user  
‘#{params[:login]}’”  
RAILS\_DEFAULT\_LOGGER.silence do  
# however you’re doing the authentication…, e.g.  
user = User.authenticate\_somehow(params[:login],  
params[:cleartext\_password\_or\_whatever])  
end  
RAILS\_DEFAULT\_LOGGER.info “Login failed!” if user.nil?  
# … and then whatever else you need to do.  
end

For extra credit, you can even make the silencing ONLY happen when  
RAILS\_ENV == ‘production’.

- james

On 2/24/06, Ken P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Thanks Ezra. Although I’d still like the transaction log, that will do until I  
> have time to test out the Plugin that Jeremy suggested.
> 
> -Ken
> 
> * * *
> 
> Rails mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

–

- J \*  
~