4 ms·
Rails logs POST and GET parameters by default.
by there 15y ago
Rails logs POST and GET parameters by default.
- ryanbrunner 15y agoStill, I think it's unrealistic to expect GitHub to parse through all of their logs. First, it would be non-trivial to detect the malicious behaviour in the first place, and secondly, keeping logs that go back multiple years is certainly non-standard, particularly at the info level.
- skeletonjelly 15y agoGET parameters I understand, but POST as well? As in the form contents? I'm finding it hard to believe you. By default?
- Volpe 15y agoWhy is that so shocking? It logs both.
- brazzy 15y agoShocking because it will produce extremely large amounts of data, makes the logs extremely security-relevant, and probably breaks all kinds of privacy laws. E.g. in the EU a user has a right to request that a company delete all data they have collected about him. So you'd have to go through your logs and purge all request data from that user - possible, but likely to be overlooked.
- skeletonjelly 15y agoGET params are a part of the URL. POST params aren't.