Open jeremyvdw opened 6 years ago
Thank you for the PR!
I do have some concerns about sending query string/parameters and form parameters in the general case, it's fairly common for those to contain secrets such as API tokens or other credentials.
@gordonsyme I do agree, that's a perfectly valid concern.
Official rollbar-gem tackle this issue with a configurable scrubber: https://github.com/rollbar/rollbar-gem/blob/efe6468af071f0a37751033dc9e35dbec224be6c/lib/rollbar/configuration.rb#L103
To keep changes minimal, I can propose to update :forms-params
and :params
to obfuscate values of a defined list of keys (i.e: :password
, :password_confirmation
, :secret
, etc..).
As of version 1.0.131, the parameters of the request is not reported to Rollbar.
From ring wiki, base request parameters look like this:
It would then make sense that those are to be reported to rollcage client like:
Also ring's
wrap-parameters
middleware adds three keys to the map::query-params
,:form-params
and:params
. As a large number of people are using this middleware, it sounds reasonable to add those as arguments sent to Rollbar.