[jira] [Commented] (DELTASPIKE-382) mask out passwords and other credentials in our Configuration logs

["Mark Struberg (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DELTASPIKE-382?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13684728#comment-13684728 ] 

Mark Struberg commented on DELTASPIKE-382:
------------------------------------------

parsing ALL log output in production is imo not a good idea. This is way too expensive and could seriously blast performance in many situations. For jenkins it doesn't harm anyone, but in a production environment this is a no-go from a performance pov.

ad #1: it's not a single DS method, it really affects the whole configuration area.
ad #3: don't see it as a pure password issue, the solution with the SPI is much more flexible. As outlined above you could e.g. also use it for a decryption handler.
ad #4: yes, I'll hack it and maintain it.
                
> mask out passwords and other credentials in our Configuration logs
> ------------------------------------------------------------------
>
>                 Key: DELTASPIKE-382
>                 URL: https://issues.apache.org/jira/browse/DELTASPIKE-382
>             Project: DeltaSpike
>          Issue Type: New Feature
>          Components: Configuration
>    Affects Versions: 0.4
>            Reporter: Mark Struberg
>            Assignee: Mark Struberg
>             Fix For: 0.5
>
>
> Our configuration mechanism currently logs all the configured values.
> This makes it hard to use it for passwords and stuff.
> I suggest we introduce some specific prefix property to configure configs which contain sensitive information.
> For the key 'some.random.password' this could look like:
> deltaspike_config.mask.some.random.password=true
> In the log we would in this case just output the information whether and where we did find some value, but not print the details for all configs which start with all of the configured masks.
> I'm not yet sure though how to configure this best. Suggestions appreciated!

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira