Skip to content
Browse files

filter_parameter_logging is deprecated in Rails 3. Changed it to conf…

…ig.filter_parameters
  • Loading branch information...
1 parent dfecb3f commit 34ed401063c016acab7c64bf1b7d21c0cfa128c7 @vijaydev vijaydev committed with fxn
Showing with 2 additions and 2 deletions.
  1. +2 −2 railties/guides/source/security.textile
View
4 railties/guides/source/security.textile
@@ -524,10 +524,10 @@ h4. Logging
-- _Tell Rails not to put passwords in the log files._
-By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can _(highlight)filter certain request parameters from your log files_ by the filter_parameter_logging method in a controller. These parameters will be marked [FILTERED] in the log.
+By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can _(highlight)filter certain request parameters from your log files_ by appending them to config.filter_parameters in the application configuration. These parameters will be marked [FILTERED] in the log.
<ruby>
-filter_parameter_logging :password
+config.filter_parameters << :password
</ruby>
h4. Good Passwords

0 comments on commit 34ed401

Please sign in to comment.
Something went wrong with that request. Please try again.