search

devict / job-board

the devICT job board!
https://jobs.devict.org
0 stars 11 forks source link

logging sensitive data #32

Open kevinfalting opened 2 years ago

kevinfalting commented 2 years ago

This is happening locally, don't know if it's also happening in prd, but we're logging the tokens for editing a post.

job-board-app-1  | 2022/09/27 14:07:07 main.go:108: server listening on port :8080
job-board-app-1  | [GIN] 2022/09/27 - 14:07:16 | 200 |    8.339653ms |      172.19.0.1 | GET      "/"
job-board-app-1  | [GIN] 2022/09/27 - 14:07:16 | 304 |    2.037051ms |      172.19.0.1 | GET      "/assets/css/app.css"
job-board-app-1  | [GIN] 2022/09/27 - 14:07:16 | 304 |    2.724662ms |      172.19.0.1 | GET      "/assets/svg/devict-logo.svg"
job-board-app-1  | [GIN] 2022/09/27 - 14:07:16 | 304 |    1.826482ms |      172.19.0.1 | GET      "/assets/svg/circuit-board.svg"
job-board-app-1  | [GIN] 2022/09/27 - 14:07:16 | 404 |       3.887µs |      172.19.0.1 | GET      "/favicon.ico"
job-board-app-1  | [GIN] 2022/09/27 - 14:07:19 | 200 |     2.62795ms |      172.19.0.1 | GET      "/new"
job-board-app-1  | [GIN] 2022/09/27 - 14:08:01 | 302 |  1.061981724s |      172.19.0.1 | POST     "/jobs"
job-board-app-1  | [GIN] 2022/09/27 - 14:08:01 | 200 |      4.1646ms |      172.19.0.1 | GET      "/"
job-board-app-1  | [GIN] 2022/09/27 - 14:09:27 | 200 |    5.221391ms |      172.19.0.1 | GET      "/jobs/54/edit?token=tvtxz2yUaSZsK4ewEuRR1wtOlGs%3D"
job-board-app-1  | [GIN] 2022/09/27 - 14:10:01 | 302 |    2.525355ms |      172.19.0.1 | POST     "/jobs/54?token=tvtxz2yUaSZsK4ewEuRR1wtOlGs%3d"
job-board-app-1  | [GIN] 2022/09/27 - 14:10:01 | 200 |    3.684014ms |      172.19.0.1 | GET      "/"
job-board-app-1  | [GIN] 2022/09/27 - 14:10:10 | 200 |    3.791154ms |      172.19.0.1 | GET      "/jobs/54"
job-board-app-1  | [GIN] 2022/09/27 - 14:10:28 | 200 |    3.905699ms |      172.19.0.1 | GET      "/jobs/54/edit?token=tvtxz2yUaSZsK4ewEuRR1wtOlGs%3D"
vicheanath commented 1 day ago

I thinks for post request it should be pull all data on payload instead of query.