search

taoensso / sente

Realtime web comms library for Clojure/Script
https://www.taoensso.com/sente
Eclipse Public License 1.0
1.73k stars 193 forks source link

Logged secrets when :client-id is nil #434

Closed NoahTheDuke closed 10 months ago

NoahTheDuke commented 10 months ago

Hey Peter!

We use Integrant to do state management and use middleware to attach the subsystems to each request: (-> req (assoc :system/db (:db system)) ...). Occasionally, there's a faulty connection (hard to tell exactly why or how, we're still diving into a related issue) and the :client-id is nil, which trips the line below. This logs the gigantic request to our logs, which includes things like production secrets that are stored in memory only.

Would it be possible to add a flag or some configuration to allow us to avoid logging in this case? We're already dealing with the thrown exception and can log a redacted form of the request as desired.

https://github.com/taoensso/sente/blob/b74608049e9f3bef78849674f3f84df92a9795e3/src/taoensso/sente.cljc#L752

ptaoussanis commented 10 months ago

@NoahTheDuke Hi Noah!

Thanks for the clear description of the problem, that was very helpful 🙏

I definitely consider this a bug, there's no need to print the full Ring request here - and the risk is better avoided.

I've just pushed v1.19.2 to Clojars that removes the logging of Ring requests on this error.

Sorry about the trouble!

Cheers :-)

NoahTheDuke commented 10 months ago

Damn, that's so quick! Thank you!