Re:How to Safely Store Your Users' Passwords in 2016
by swang on Wednesday February 17, 2016 @10:41PM
(#11123558)
I don't see how moving to the web server would prevent that if you were logging passed req body or query parameters since they would be posted in plaintext (hopefully) over a https connection.
[ Parent
| on HN ]
Re:How to Safely Store Your Users' Passwords in 2016
by minitech on Wednesday February 17, 2016 @11:19PM
(#11123696)
“query parameters” here are the parameters passed to PostgreSQL. That is, "SELECT * FROM users WHERE password_hash = get_hash('P4ssw0rd')" is being logged, not "?password=P4ssw0rd".
Re:How to Safely Store Your Users' Passwords in 2016
by NickNameNick on Thursday February 18, 2016 @06:27AM
(#11125055)
Exactly so.
The webserver framework I was using at the time logged all its queries to the database at the normal log level. It couldn't log an actual query string because we used prepared statements, but it reconstructed the query and substituted the parameters in.
Enormously helpful for debugging an issue, when you can just copy and paste a query out of the serverlogs. Although I would probably have preferred that it not do that at the normal log level.
Curiously, it never logged the http request string/parameters. When I wanted that I had to add my own code to the request handler.