Agent WranglersAPS-79Recommended
Keep private data out of logs and addresses
Never put passwords, tokens, card numbers or personal details in addresses or logs.
How to do it
Send private values in the request body or a header, never in the query string. Addresses end up in logs, browser history and Referer headers, as keep personal data out of addresses explains. Redact fields in the logger and drop IP addresses as keep personal data out of logs says. This rule is the attack test for both. Collect less in the first place, as in data minimization.
How to check
The agent logs in, resets a password and places a test order. Then it searches the staging logs for the test password, token and email address. None of them appear.
Sources
Related rules
- ENG-23 Log, track errors and alert in Engineering
- WEB-212 Keep only what you need and delete it on time in Website
- OPS-9 Keep personal data out of logs in Operations and observability
- OPS-13 Keep metric labels few and bounded in Operations and observability
- DEV-7 Take secrets from the environment or a file instead of a flag in Developer tools, SDKs and CLIs
- APS-31 Share less in the Referer header in Application security
- WEB-214 Keep personal data out of addresses in Website
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/private-data-out-of-logs">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.