Skip to content

haskell-gargantext
haskell-gargantext
Merged
Opened by Alfredo Di Napoli@AlfredoDiNapoli
Report abuse

Sanitise logged requests

Fixes #298 (closed).

This commit introduces a slight variation to the logStdOutDev middleware which is capable of redacting secrets from our gargantext requests.

This way we can run the server in dev mode (for instrumentation purposes) without leaking users' secrets.

@anoe Thanks to this patch, we now obfuscate in the logs things like the login password and the PubMed API key supplied for corpus searches. If you have in mind other sensitive information we might be leaking, feel free to share them here, or add the relevant keyword to the list called sensitiveKeywords inside Gargantext.API.Middleware.

We filter these keywords from any JSON body payload and from any query parameter (in case of GET requests).

It took me more than expected to code this patch as wai-extra didn't make it super easy to accomplish what we wanted, and I had to crib some code over.

Demo

When running the server with Dev mode enabled, this was the output before this patch:

Screenshot_2024-01-15_at_12.15.35

This is the result after:

Screenshot_2024-01-15_at_16.13.53

Screenshot_2024-01-15_at_16.14.44