# Unencrypted Password Appears in Log

**URL:** <https://www.ruby-forum.com/t/unencrypted-password-appears-in-log/91961>\
**Category:** Rails\
**Created:** [April 13, 2007, 8:21pm UTC](https://www.ruby-forum.com/t/unencrypted-password-appears-in-log/91961 "2007-04-13T20:21:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![randall](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/b38774/32.png) [@randall](https://www.ruby-forum.com/u/randall)\
**Post date:** [April 13, 2007, 8:21pm UTC](https://www.ruby-forum.com/t/unencrypted-password-appears-in-log/91961/1 "2007-04-13T20:21:01Z")

</div>

I have a requirement to authenticate my app users through Active  
Directory. My login form captures a user’s ID and password and passes  
them to a net/ldap routine. I’m using form\_for…|form| to create  
the form and form.password\_field to create the password field. The  
password entry is encrypted on the screen but appears unencrypted in  
the development log in the params listing.

What can I do to keep the unencrypted password from appearing in the  
log?

Thanks,

Mike

---

<div class="post-metadata">

**Author:** ![randall](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/b38774/32.png) [@randall](https://www.ruby-forum.com/u/randall)\
**Post date:** [April 13, 2007, 8:34pm UTC](https://www.ruby-forum.com/t/unencrypted-password-appears-in-log/91961/2 "2007-04-13T20:34:03Z")

</div>

Hi Mike,

imdwalrus wrote:

> What can I do to keep the unencrypted password from  
> appearing in the log?

I have a requirement to filter _all_ user input from my logs, so this  
isn’t  
specific to passwords. This’ll get you in the ballpark, though.

Inside application.rb, outside the methods

if %w(production).include?(ENV[‘RAILS\_ENV’])  
filter\_parameter\_logging { |k,v| v.replace ‘’ unless k ==  
‘controller’ or  
k == ‘action’}  
end

hth,  
Bill

---

<div class="post-metadata">

**Author:** ![randall](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/b38774/32.png) [@randall](https://www.ruby-forum.com/u/randall)\
**Post date:** [April 13, 2007, 9:00pm UTC](https://www.ruby-forum.com/t/unencrypted-password-appears-in-log/91961/3 "2007-04-13T21:00:06Z")

</div>

Use filter\_parameter\_logging:

> **[ActionController::Base](https://api.rubyonrails.org/classes/ActionController/Base.html#M000260)**
>
> Action Controllers are the core of a web request in Rails. They are made up of one or more actions that are executed on request and then either it renders a template or redirects to another action.

You can stick this in your ApplicationController, or do it on a per-  
controller basis.

Chris

---

<div class="post-metadata">

**Author:** ![randall](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/b38774/32.png) [@randall](https://www.ruby-forum.com/u/randall)\
**Post date:** [April 13, 2007, 11:32pm UTC](https://www.ruby-forum.com/t/unencrypted-password-appears-in-log/91961/4 "2007-04-13T23:32:26Z")

</div>

Thanks, Bill. I really appreciate your help.

---

<div class="post-metadata">

**Author:** ![randall](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/b38774/32.png) [@randall](https://www.ruby-forum.com/u/randall)\
**Post date:** [April 14, 2007, 12:38am UTC](https://www.ruby-forum.com/t/unencrypted-password-appears-in-log/91961/5 "2007-04-14T00:38:31Z")

</div>

That’s perfect, Chris. Thanks so much for taking the time to help me.

– Mike