4 ms·
You can log all HTTP requests and it is standard practice to do so at the load balancer level (haproxy and co have very configurable logging). However you MUST
by user5994461 6y ago
You can log all HTTP requests and it is standard practice to do so at the load balancer level (haproxy and co have very configurable logging).
However you MUST NOT logs cookies or headers or content, because these can contain private information.
Last but not least, developers should never pass tokens/passwords in the request path because it will be systematically logged and leaked /api/token/abcdec. That should go into a header or the body.
- happy_pancake 6y agoSingle-used tokens are fine to be passed in the path right? Like email verification /token/{token}
- stonemetal12 6y agoDefense in depth says No, not Ok. For example: Accidentally open to the internet log server(as above). Attacker sends password reset request. Attacker checks log to steal token. Attacker now has stolen account until owner can't log in and does reset, or perhaps semi-permanently if attacker steals all tokens for said account and invalidates them before owner can use them.
- tialaramex 6y agoFor email verification it's less scary if that was really all you wanted. If you believe you're verifying that the email went to your user, this isn't enough. Lots of systems parse URLs out of emails and follow them, you probably want to look for a a pre-existing session cookie, or insist the user log in from the verification page and confirm this is what they wanted. Otherwise you've merely got two unrelated facts: 1. Some user of your system (maybe happy_pancake) says bob@example.com is their email address 2. Mail to bob@example.com is received by a machine or person which reads web pages. It would be foolish to conclude from these facts that happy_pancake is actually bob@example.com or that bob@example.com wants to use your service.