3 ms·
If you're building a server application, you should be aware of the kinds of information you're writing to your application log. The first obvious issue is that
by ak217 8y ago
If you're building a server application, you should be aware of the kinds of information you're writing to your application log. The first obvious issue is that of possibly disclosing information if the traceback is returned to the client instead of saved in the server log. The second, less obvious question is what kinds of statutory requirements you are under regarding retention of PII in your logs. And in the worst case scenario, you could end up writing out things like plaintext passwords and unrelated PII from the environment.
I bring this up because this looks like it discloses variable values into the log that would not be printed in a standard traceback under most normal circumstances.
- pmiller2 8y ago+1 to this. We have some middleware that scrubs our database exceptions for precisely this reason. You need to think about this any time you're logging the value of any variable, if your company handles any PII or other sensitive information whatsoever.