Blog Post RSS ?

Blogs » Ruby on Rails » Securing your production.log
 

Securing your production.log

by Tim Lucas

By default Rails logs all your POST parameters in both development and production. If you are accepting credit card numbers, passwords or other sensitive information then all this data will end up in plain text in your production.log file. Not very cool.

Changing your log level to :warn prevents the logging of requests and their parameterse. To make this change add the following line to your application’s config/environments/production.rb file:

config.log_level = :warn

The only problem with the above method is that you lose lots of useful information. Ideally you just want to make sure specific actions or parameters don’t get logged. Luckily for you somebody’s already figured out how to do this: Kent Sibilev’s plugin code posted to the Rails mailing list back in February excludes params for entire actions, and the filter_logged_params plugin let’s you specify parameter keys to filter out across all actions.

Happy secure logging!

(credit for making me aware of this problem goes to Jeremy at segpub)

This post has 2 responses so far

  1. Thanks for the terrific post on securing the production.log! That’s exactly what I needed.

     
  2. With Rails 1.1.5+ you can use the new ActionController#filter_parameter_logging method to filter out sensitive information from your logs

     

Sponsored Links

Leave a response

You are not logged in, log in with your SitePoint Forum username and password.

-OR- Post Anonymously

* Make sure any code samples are escaped (i.e. ‘<b>’ becomes ‘&lt;b&gt;’).

If not logged in, your comments will be placed in a moderation queue. This means your comment may not appear until one of our moderators approves it.

SitePoint Marketplace

Buy and sell Websites, templates, domain names, hosting, graphics and more.