Skip to content

Conversation

@JrSchild
Copy link

Description

When a malformed JSON body is sent to an onCall function, the entire request object will be logged. This is undesirable for the following reasons:

  1. The object might contain sensitive data, which could be non-compliant with internal or regulatory privacy rules.
  2. Each line in the output console, results in a structure log write which makes it easy to hit logging quota's. There are hundreds of logs per invalid request (picture below for just the first few lines).
  3. Hitting logging quota's can be quite easily used for malicious purposes.
  4. The output logs can become cluttered.

Screenshot 2020-07-22 at 10 46 10

@mbleigh
Copy link
Contributor

mbleigh commented Jul 22, 2020

@JrSchild thanks very much for the pull request! This is definitely an issue, as we hadn't updated internal logging in the SDK to be compatible with newer runtimes (and I agree about not logging the full request). I wanted to do a bigger cleanup, so I've superseded this PR with #745 but thanks very much for posting!

@mbleigh mbleigh closed this Jul 22, 2020
@JrSchild
Copy link
Author

Works for me @mbleigh! Thanks for picking it up straight away.

@JrSchild JrSchild deleted the feat/do-not-log-request branch July 22, 2020 16:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants