# Possible Rails Security Issue? **URL:** \ **Category:** Rails\ **Created:** [February 7, 2006, 6:57pm UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498 "2006-02-07T18:57:05Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![kschell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a698b9/32.png) [@kschell](https://www.ruby-forum.com/u/kschell)\ **Post date:** [February 7, 2006, 6:57pm UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498/1 "2006-02-07T18:57:05Z")
I have an e-commerce site and users check out with a form. The results of that form are sent to a “confirm your order” page via POST. I take great pains to NEVER store the full credit card number on my server–just the last 4 digits. I was very surprised to find that by default Rails will record POST requests with parameters in the production.log. And those parameters include credit card numbers! I know that log levels can be customized and adjusted to show only errors but it seems like the default Rails behavior should be to NOT log the POST parameters when in production mode. Is this something that needs to be addressed? If so, what’s the correct way to escalate it? At the very least, I think there should be clear warnings and documentation about this fact. Kevin S. * * * Here’s a sample from my log with the personal information stripped out by hand: Processing StoreController#checkout (for xxx.xxx.xxx.xxx at 2006-02-06 09:38:27) [GET] Parameters: {“action”=\>“checkout”, “controller”=\>“store”} Rendering within layouts/store Rendering store/checkout Start rendering component ({:action=\>“display\_cart”}): Processing StoreController#confirm\_order (for xxx.xxx.xxx.xxx at 2006-02-06 09:39:32) [POST] Parameters: {“commit”=\>" Continue “, “action”=\>“confirm\_order”, “payment”=\>{“card\_type”=\>“M”, “card\_number”=\>“0000000000000000”, “pay\_type”=\>“cc”, “card\_expiration(1i)”=\>“2007”, “card\_expiration (2i)”=\>“7”}, “controller”=\>“store”, “customer”=\>{“company”=\>“Xxxxx”, “city”=\>“Xxxxx”, “zip”=\>“00000”, “country”=\>“US”, “suite”=\>”", “phone”=\>“000-000-0000”, “first\_name”=\>“Xxxxx”, “address”=\>“00 Xxxxxxx”, “last\_name”=\>“Xxxxx”, “email”=\>“removed\_email\_address@domain.invalid”, “state”=\>“XX”}} Rendering within layouts/store Rendering store/confirm\_order Start rendering component ({:action=\>“display\_cart”}): ---
**Author:** ![kschell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a698b9/32.png) [@kschell](https://www.ruby-forum.com/u/kschell)\ **Post date:** [February 7, 2006, 7:06pm UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498/2 "2006-02-07T19:06:43Z")
I have noticed this to with users logging in. The plain password is available via the log. I guess one argument could be that the logs on on your server, and should only be available to authorized personnel. ~ Ben On 2/7/06, Kevin S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Processing StoreController#checkout (for xxx.xxx.xxx.xxx at > “pay\_type”=\>“cc”, “card\_expiration(1i)”=\>“2007”, "card\_expiration > > * * * > > Rails mailing list > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) – Ben R. [http://www.benr75.com](http://www.benr75.com) ---
**Author:** ![kschell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a698b9/32.png) [@kschell](https://www.ruby-forum.com/u/kschell)\ **Post date:** [February 7, 2006, 7:09pm UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498/3 "2006-02-07T19:09:47Z")
~ Quick typing created a rather poor post… Here is a patch 😉 I have noticed this too with users logging in. The plain password is available via the log. I guess one argument could be that the logs are on your server, and should only be available to authorized personnel. ~ Ben On 2/7/06, Ben R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > on my server–just the last 4 digits. I was very surprised to find > > > > Rendering store/checkout > > Xxxxxxx", “last\_name”=\>“Xxxxx”, “email”=\>“removed\_email\_address@domain.invalid”, > > – > Ben R. > [http://www.benr75.com](http://www.benr75.com) – Ben R. [http://www.benr75.com](http://www.benr75.com) ---
**Author:** ![kschell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a698b9/32.png) [@kschell](https://www.ruby-forum.com/u/kschell)\ **Post date:** [February 7, 2006, 8:13pm UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498/4 "2006-02-07T20:13:40Z")
I personally do not feel that this is a Rails security issue - But I do HIGHLY recommend that it is pointed out very, very plainly that by default, all POSTS are sent to the server logs…it should be up to the developer to make adjustments as needed for the project. One persons “no-no” is someone else’s “yes, please” - this is why I think Rails is just fine, but again, it should be set with a big warning in the docs on what Rails logs. Joseph Youngquist ---
**Author:** ![kschell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a698b9/32.png) [@kschell](https://www.ruby-forum.com/u/kschell)\ **Post date:** [February 7, 2006, 7:47pm UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498/5 "2006-02-07T19:47:39Z")
Pretty poor argument given that the regulations around credit card security are pretty specific about what you can and cannot do with CC numbers. Storing them anywhere in a non-encrypted format is a big no- no. I am guessing Kevin does not want to store them to avoid having to deal with PCI regulations that would require additional security process to be in place. This sounds like something that should be clearly spelled out in the docs somewhere. On Feb 7, 2006, at 10:06 AM, Ben R. wrote: > > I have noticed this to with users logging in. The plain password is > > > > > on my server–just the last 4 digits. I was very surprised to find > > > be clear warnings and documentation about this fact. > > > Rendering within layouts/store > > > “phone”=\>“000-000-0000”, “first\_name”=\>“Xxxxx”, “address”=\>"00 > > > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) > > > Ben R. > > > [http://www.benr75.com](http://www.benr75.com) > > * * * > > Rails mailing list > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) - Bill ---
**Author:** ![kschell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a698b9/32.png) [@kschell](https://www.ruby-forum.com/u/kschell)\ **Post date:** [February 7, 2006, 8:22pm UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498/6 "2006-02-07T20:22:47Z")
Is there any way of automatically stopping all password fields from being added to the logs? Estelle. ---
**Author:** ![kschell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a698b9/32.png) [@kschell](https://www.ruby-forum.com/u/kschell)\ **Post date:** [February 8, 2006, 7:12am UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498/7 "2006-02-08T07:12:36Z")
On 2/7/06, Estelle W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Is there any way of automatically stopping all password fields from > being added to the logs? There’s always the Filter Logged Params plugin: [http://wiki.rubyonrails.org/rails/pages/Filter+Logged+Params+Plugin](http://wiki.rubyonrails.org/rails/pages/Filter+Logged+Params+Plugin) ---
**Author:** ![kschell](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/a698b9/32.png) [@kschell](https://www.ruby-forum.com/u/kschell)\ **Post date:** [February 7, 2006, 9:16pm UTC](https://www.ruby-forum.com/t/possible-rails-security-issue/53498/8 "2006-02-07T21:16:57Z")
I did not mean to imply it was a rails issue per-se, just that it should be clearly spelled out somewhere. Logging of the POST data is not something that is standard IMO and therefore should be brought to the attention of security conscious developers. My argument would be to not have it turned on by default, the default level would be WARN, but then again I have a large collection of hats in various metals. 🙂 On Feb 7, 2006, at 11:11 AM, Joe Y. wrote: > Joseph Youngquist > > > available via the log. I guess one argument could be that the logs > > > > > logs on > > > > > > > on my server–just the last 4 digits. I was very surprised to > > > > Is this something that needs to be addressed? If so, what’s the > > > > Processing StoreController#checkout (for xxx.xxx.xxx.xxx at > > > > “pay\_type”=\>“cc”, “card\_expiration(1i)”=\>“2007”, "card\_expiration > > Rails mailing list > removed\_email\_address@domain.invalid > [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails) - Bill