search

digitalbazaar / bedrock-mongodb

Bedrock mongodb module
Apache License 2.0
2 stars 3 forks source link

Adjust logging for config.url #58

Closed mattcollier closed 3 years ago

mattcollier commented 3 years ago

There are many instances where config.url is being logged. This url will often include login credentials in the form:

mongodb://my-user:my-password@mongos.example.com:27075/my_database?ssl=true

Login credentials should not be surfaced in the logs. This needs to be updated immediately and therefore I propose that all logging of config.url be removed entirely. Perhaps in the future a more sophisticated logging method that redacts the credentials can be developed.

See: https://github.com/digitalbazaar/bedrock-mongodb/blob/master/lib/index.js#L101

mattcollier commented 3 years ago

Work on this should be based on the branch associated with this PR: https://github.com/digitalbazaar/bedrock-mongodb/pull/57

dmitrizagidulin commented 3 years ago

+1.