I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging.
I've gotten into the habit of using log4j2's Logger.entry() and Logger.exit() methods for TRACE level logging, and the exit() method has the option of including the return value for a method.
In this particular instance, I'm overriding DatabaseServerLoginModule's createPasswordHash() method and I'm wondering if I need to skip including the return value in log.exit() - but it would be really helpful to see that the hashes being used to login match (or not) the hashes I am creating to register.
It smells wrong, but on my own I can't seem to come up with any reason not to since someone with access to the logs still wouldn't know what hash algorithm I used, how many iterations, salt, etc. But then again, I'm not the hacker trying to break into this account.