Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DefaultWebClient logging sensitive information in URI #29148

Closed
itsnagaraj opened this issue Sep 13, 2022 · 0 comments
Closed

DefaultWebClient logging sensitive information in URI #29148

itsnagaraj opened this issue Sep 13, 2022 · 0 comments
Assignees
Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: bug A general bug
Milestone

Comments

@itsnagaraj
Copy link

Affects: v5.3.22 and prior. Module is spring-webflux

The insertCheckpoint method in DefaultWebClient seems to log the URI. In few scenarios this URI can have sensitive information like email or phone number or name etc.,. The framework doesn't provide any controls to switch it off and the only way I can think of right now is to create a duplicate of this class in our classpath and override this method. Any other suggestions are appreciated.? If future versions of spring-webflux can provide a way to override the behaviour that will provide us a strategic alternative.

private <T> Mono<T> insertCheckpoint(Mono<T> result, HttpStatusCode statusCode, HttpRequest request) {
	HttpMethod httpMethod = request.getMethod();
	URI uri = request.getURI();
	String description = statusCode + " from " + httpMethod + " " + uri + " [DefaultWebClient]";
       return result.checkpoint(description);
}


@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Sep 13, 2022
@rstoyanchev rstoyanchev self-assigned this Sep 16, 2022
@rstoyanchev rstoyanchev added in: web Issues in web modules (web, webmvc, webflux, websocket) type: bug A general bug and removed status: waiting-for-triage An issue we've not yet triaged or decided on labels Sep 16, 2022
@rstoyanchev rstoyanchev added this to the 5.3.24 milestone Sep 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: web Issues in web modules (web, webmvc, webflux, websocket) type: bug A general bug
Projects
None yet
Development

No branches or pull requests

3 participants