Skip to main content
Tweeted twitter.com/StackSecurity/status/720075379860447232
Updated trying to make it clearer that all the logs happens on the server side.
Source Link
Alexis Wilke
  • 1.1k
  • 9
  • 26

As I am working on a website that asks customers to enter data such as their name, address, phone number, I obviously have customer data that needs to be protected.

I do my best to not log such data (although I have two levels of logs: normal and secure, and would use the secure log area for such), I am wondering whether an application is expected to still not log customer data when in debug or trace mode. All those logs happen on the server side. The client has no control over it.

In my current implementation, the normal release mode would not do so in INFO, WARNING, or ERROR log levels, but the debug andDEBUG/or traceTRACE levels might leak some of that information to the logs. Is that expected behavior in most appswebsite servers? Or should we attempt to limit such leaks even when in debugDEBUG, TRACE mode? (note that our C++ application is compiled in release mode, the "DEBUG" in this case references the log level and not whether some debug code is still in the software.)

Note that the application can be logging the data on another computer or even a third party system so security wise access to the logs is independent of access to the website server application or the database where, obviously, the data lays for sure. However, I can imagine some people having lower security requirements on their log computers than the computers with the database...

As I am working on a website that asks customers to enter data such as their name, address, phone number, I obviously have customer data that needs to be protected.

I do my best to not log such data (although I have two levels of logs: normal and secure, and would use the secure log area for such), I am wondering whether an application is expected to still not log customer data when in debug or trace mode.

In my current implementation, the release mode would not do so, but the debug and/or trace might leak some of that information to the logs. Is that expected behavior in most apps? Or should we attempt to limit such leaks even when in debug mode?

Note that the application can be logging the data on another computer or even a third party system so security wise access to the logs is independent of access to the application or the database where, obviously, the data lays for sure. However, I can imagine some people having lower security on their log computers than the computers with the database...

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected.

I do my best to not log such data (although I have two levels of logs: normal and secure, and would use the secure log area for such), I am wondering whether an application is expected to still not log customer data when in debug or trace mode. All those logs happen on the server side. The client has no control over it.

In my current implementation, the normal release mode would not do so in INFO, WARNING, or ERROR log levels, but the DEBUG/TRACE levels might leak some of that information to the logs. Is that expected behavior in most website servers? Or should we attempt to limit such leaks even when in DEBUG, TRACE mode? (note that our C++ application is compiled in release mode, the "DEBUG" in this case references the log level and not whether some debug code is still in the software.)

Note that the application can be logging the data on another computer or even a third party system so security wise access to the logs is independent of access to the website server application or the database where, obviously, the data lays for sure. However, I can imagine some people having lower security requirements on their log computers than the computers with the database...

Source Link
Alexis Wilke
  • 1.1k
  • 9
  • 26

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, I obviously have customer data that needs to be protected.

I do my best to not log such data (although I have two levels of logs: normal and secure, and would use the secure log area for such), I am wondering whether an application is expected to still not log customer data when in debug or trace mode.

In my current implementation, the release mode would not do so, but the debug and/or trace might leak some of that information to the logs. Is that expected behavior in most apps? Or should we attempt to limit such leaks even when in debug mode?

Note that the application can be logging the data on another computer or even a third party system so security wise access to the logs is independent of access to the application or the database where, obviously, the data lays for sure. However, I can imagine some people having lower security on their log computers than the computers with the database...