I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I am kind of confused because some times logging statements can contain personal information like contact details, names and such. (No card or bank account details)

The minimum logging level at production would be info which means debug statements would be basically no-op. But I was wondering that can it be used as a security vulnerability?

  • If you use parameterized queries, the query itself shouldn't contain any data, only the parameters. Aug 6 '20 at 12:24
  • I use parameterized queries. Though what I am logging is the final query @CodesInChaos
    – Hemil
    Aug 6 '20 at 13:53
  • @CodesInChaos it makes no sense for me to log the parameterized query as it is already there in the source code
    – Hemil
    Aug 6 '20 at 13:54

You are talking around the idea of "data classification" without actually talking about it.

The data in your database has a certain level of data classification, whether you formally assign a classification or not. You secure and control this information based on its sensitivity and classification (e.g. passwords, personal data, company-sensitive data, etc.).

If you log query data, then those logs now have this data and should be secured and controlled in the same way as the database.

To not secure and control this data in the same way in line with the security and controls in the database that supports the data classification, then, yes, you are inappropriately exposing this data.

So, yes, it is ok to run debug logs of queries, as long as you secure and control it in line with the protections the data requires.

  • Does this mean, it is okay to debug log the queries but ensure that log level in not debug in production but i can use debug level while testing and staging?
    – Hemil
    Aug 6 '20 at 10:45
  • I don't know your environment, so I cannot say one way or the other. The point is not "production" or "test" or "staging". The only point is "appropriate protections". Whatever environment you run this on, the data needs to be protected in line with its classification.
    – schroeder
    Aug 6 '20 at 10:47
  • I am currently on heroku which requires my credentials to access logs. Is that what you mean?
    – Hemil
    Aug 6 '20 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.