Not filtering query string params

[bluengreen]

I'm seeing sensitive data logged (api keys, etc) that is coming from the querystring. The path isn't being filtered for the query string. Any suggestions on how to do that other than remove the action / controller from being logged?

[benlovell]

When you append the params to your payload make sure you do it with your request’s `filtered_parameters`. Otherwise you’re including params pre the filtering.

…

Sent from my iPhone

On 27 Sep 2017, at 21:54, Phillip Novess ***@***.***> wrote: I'm seeing sensitive data logged that is coming from the querystring. The path isn't being filtered for the query string. Any suggestions on how to do that other than remove the action / controller from being logged? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[bluengreen]

Hmm. I'm not changing the payload. And only the query string params are the issue. All others are filtered.

[benlovell]

OK, they're being included in the path? The easiest thing to do is to exclude that action as you rightly stated. Otherwise, I'd happily accept a patch that performs the requisite filtering at Lograge::RequestLogSubscriber#extract_path.