# Rails and security

**URL:** <https://www.ruby-forum.com/t/rails-and-security/151052>\
**Category:** Rails\
**Created:** [October 16, 2008, 11:26am UTC](https://www.ruby-forum.com/t/rails-and-security/151052 "2008-10-16T11:26:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrdamien](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e274bd/32.png) [@mrdamien](https://www.ruby-forum.com/u/mrdamien)\
**Post date:** [October 16, 2008, 11:26am UTC](https://www.ruby-forum.com/t/rails-and-security/151052/1 "2008-10-16T11:26:21Z")

</div>

Hi,

I am wondering if there is a way to secure rails application logs ?

My issue is that I discovered that form parameters are shown in clear in  
the logs. So when users are authenticating, you see the login and  
password in clear

Processing LoginController#index (for xxxxx at 2008-10-16 11:22:43)  
[POST]  
Session ID: 8cb95e2e50332added5715eff9e84938  
Parameters:  
{“authenticity\_token”=\>“f2ccf4bf93a1a334e5b3ed227eef84e12fafbbf6”,  
“action”=\>“index”, “controller”=\>“login”, “password”=\>“toto”,  
“login”=\>“r386528”}

Is there any way to hide this ?

---

<div class="post-metadata">

**Author:** ![mrdamien](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e274bd/32.png) [@mrdamien](https://www.ruby-forum.com/u/mrdamien)\
**Post date:** [October 16, 2008, 11:29am UTC](https://www.ruby-forum.com/t/rails-and-security/151052/2 "2008-10-16T11:29:14Z")

</div>

> **[Filtered parameter logging](https://rubyonrails.org/2006/8/21/filtered-parameter-logging)**
>
> Now that the hubbub about the recent security issues has died down, I think it’s worth pointing out a little jewel that was snuck into the 1.1.6 security release of Rails that most people missed.

Regards

MR Damien escribió:

> Session ID: 8cb95e2e50332added5715eff9e84938  
> Parameters:  
> {“authenticity\_token”=\>“f2ccf4bf93a1a334e5b3ed227eef84e12fafbbf6”,  
> “action”=\>“index”, “controller”=\>“login”, “password”=\>“toto”,  
> “login”=\>“r386528”}
> 
> Is there any way to hide this ?

/\*\*

- dagi3d v4 - [http://dagi3d.net](http://dagi3d.net)  
\*/

---

<div class="post-metadata">

**Author:** ![mrdamien](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e274bd/32.png) [@mrdamien](https://www.ruby-forum.com/u/mrdamien)\
**Post date:** [October 18, 2008, 2:20pm UTC](https://www.ruby-forum.com/t/rails-and-security/151052/3 "2008-10-18T14:20:32Z")

</div>

Borja Martín wrote:

> [Ruby on Rails — Filtered parameter logging](http://weblog.rubyonrails.org/2006/8/21/filtered-parameter-logging)
> 
> Regards

That worked, thanks !