Merge branch 'master' of github.com:ianheggie/health_check

README.rdoc

@@ -4,7 +4,7 @@ Simple health check of Rails edge apps for use with Pingdom, NewRelic, EngineYar
 
 The basic goal is to quickly check that rails is up and running and that it has access to correctly configured resources (database, email gateway)
 
-*This is a development branch for edge rails and may be broken at times. Use*
+*This is a development branch and may be broken at times.** Use:
 * {rails5}[https://github.com/ianheggie/health_check/tree/rails5] branch or gem versions ~> 3.0 for Rails 5.x;
 * {rails4}[https://github.com/ianheggie/health_check/tree/rails4] branch or gem versions ~> 2.0 for Rails 4.x;
 * {rails3}[https://github.com/ianheggie/health_check/tree/rails3] branch or gem versions ~> 1.7 for Rails 3.x;
@@ -142,6 +142,10 @@ To change the configuration of health_check, create a file `config/initializers/
 
       # When redis url is non-standard
       config.redis_url = 'redis_url'
+
+      # Disable the error message to prevent /health_check from leaking
+      # sensitive information
+      config.include_error_in_response_body = false
     end
 
 You may call add_custom_check multiple times with different tests. These tests will be included in the default list ("standard").

lib/health_check.rb

@@ -11,6 +11,10 @@ class Engine < Rails::Engine
   mattr_accessor :success
   self.success = "success"
 
+  # Text output upon failure
+  mattr_accessor :failure
+  self.failure = "failure"
+
   # Timeout in seconds used when checking smtp server
   mattr_accessor :smtp_timeout
   self.smtp_timeout = 30.0
@@ -67,6 +71,11 @@ class Engine < Rails::Engine
   mattr_accessor :redis_url
   self.redis_url = nil
 
+  # Include the error in the response body. You may want to set this to false
+  # if your /health_check endpoint is open to the public internet
+  mattr_accessor :include_error_in_response_body
+  self.include_error_in_response_body = true
+
   def self.add_custom_check(name = 'custom', &block)
     custom_checks[name] ||= [ ]
     custom_checks[name] << block

lib/health_check/health_check_controller.rb

@@ -25,10 +25,10 @@ def index
         end
         response.headers['Cache-control'] = (public ? 'public' : 'private') + ', no-cache, must-revalidate' + (max_age > 0 ? ", max-age=#{max_age}" : '')
         if errors.blank?
-          send_response nil, :ok, :ok
+          send_response true, nil, :ok, :ok
         else
-          msg = "health_check failed: #{errors}"
-          send_response msg, HealthCheck.http_status_for_error_text, HealthCheck.http_status_for_error_object
+          msg = HealthCheck.include_error_in_response_body ? "health_check failed: #{errors}" : nil
+          send_response false, msg, HealthCheck.http_status_for_error_text, HealthCheck.http_status_for_error_object
           # Log a single line as some uptime checkers only record that it failed, not the text returned
           if logger
             logger.info msg
@@ -39,9 +39,8 @@ def index
 
     protected
 
-    def send_response(msg, text_status, obj_status)
-      healthy = !msg
-      msg ||= HealthCheck.success
+    def send_response(healthy, msg, text_status, obj_status)
+      msg ||= healthy ? HealthCheck.success : HealthCheck.failure
       obj = { :healthy => healthy, :message => msg}
       respond_to do |format|
         format.html { render :plain => msg, :status => text_status, :content_type => 'text/plain' }

test/setup_railsapp

@@ -180,6 +180,7 @@ HealthCheck.setup do |config|
     ''
   end
 
+  config.include_error_in_response_body = false if ENV['HIDE_ERROR_RESPONSE'].present?
 end
 !
 

test/test_with_railsapp

@@ -309,6 +309,21 @@ common_tests()
         echo
     fi
 
+    export HIDE_ERROR_RESPONSE=true
+    stop_server
+    start_server
+
+    test_no=`expr 1 + $test_no`
+    if [ -z "$run_test" ] || [ $test_no == "$run_test" ]; then
+        echo "${test_no}: TESTING ${route_prefix}/database should have response body 'failure' if include_error_in_response_body is false"
+        $testurl ${host}/${route_prefix}/database 550 text/plain failure
+        echo
+    fi
+
+    unset HIDE_ERROR_RESPONSE
+    stop_server
+    start_server
+
     test_no=`expr 1 + $test_no`
     if [ -z "$run_test" ] || [ $test_no == "$run_test" ]; then
         echo "${test_no}: TESTING ${route_prefix}/site should pass ..."
@@ -661,4 +676,4 @@ rm -f $catchall_file
 finish PASSED 0
 exit 0
 
-# vi: sw=4 ai sm:
+# vi: sw=4 ai sm: