Skip to content

Commit

Permalink
fixed font
Browse files Browse the repository at this point in the history
  • Loading branch information
vijaydev committed Dec 15, 2010
1 parent 7b0e1cb commit 7a028ea
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion railties/guides/source/security.textile
Expand Up @@ -524,7 +524,7 @@ h4. Logging

-- _Tell Rails not to put passwords in the log files._

By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can _(highlight)filter certain request parameters from your log files_ by appending them to config.filter_parameters in the application configuration. These parameters will be marked [FILTERED] in the log.
By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can _(highlight)filter certain request parameters from your log files_ by appending them to <tt>config.filter_parameters</tt> in the application configuration. These parameters will be marked [FILTERED] in the log.

<ruby>
config.filter_parameters << :password
Expand Down

0 comments on commit 7a028ea

Please sign in to comment.