allskonar

Usually when you think you are doing everything right, when it comes to protecting sensitive data. You might even brag to your friends how smart you were saying that you have all password securely stowed away in your user database as hash values generated with salt through some crazy algorithm, and not as clear text. You tell them that there is no way to retrieve, a forgotten password, and the only solution is to reset it. But are you sure? have you looked at your log files?

As I was going through my production.log looking for optimize opportunities I noticed that the values of the fields posted to my rails application where diligently being logged, which is alright for most things but not passwords and other things you don’t want the liability to know about, so you never want them stored in clear text. After panicking for a little while I quickly realized that there was a quick solution as always when you’re developing in Rails, filter_parameter.

class someController < ApplicationController
  filter_parameter_logging :password, :password_confirmation

  def some_method
    . . .
  end
    . . .

end

Although I feel a bit ashamed not having known about this security issue it made me feel a bit better that my rather recent download of mephisto 0.7.3 also stores passwords in the log file. So I guess this even happens to more experienced developers. P.S. Mephisto is really awesome.

—Update [8/5 2007] the most recent trunk of Mephisto this had been fixed.

This is perhaps yet another reason to adopt openid! Assuming the provider you choose knows about all of these pitfalls in what ever technology they use.