Masking data from exception message while logging

Question

If any exception occurs in the code, we have logged the exception using the logback logger. While logging we have directly passed the exception object e to the error method.

The exception which has been thrown from a third party jar contains sensitive information like username and password. Currently, we have the username and password as the private field in the code. But it does not seem appropriate to check for check log message do string comparison and then log.

As the exception is thrown by the third party API, fixed pattern for the exception is not known. That's why we are not able to use the %replace.

What is a good way to mask the sensitive data in the exception?

You can create generic exception handler which will be filtering that information by string comparsion. Is it possible? — ByeBye
– ByeBye, Commented Aug 8, 2017 at 12:07
If you can't know what the sensitive data in the message looks like and how to reliably locate it (e.g. location or surrounding patterns) you either have the option to not log anything, mask as much as possible (e.g. the entire part between the exception name and the stacktrace) or best tackle the problem at its root: in the library or at least where you log the exception. — Thomas
– Thomas, Commented Aug 8, 2017 at 12:07
You log what you need. If you know the type of the exception that contains sensitive data just log a brief prepared message — bichito
– bichito, Commented Aug 8, 2017 at 12:09
Actually for the current exception, we know what we want to mask. We have the username and password value. But we have to do string comparison before each log with list of values. — anand mahuli
– anand mahuli, Commented Aug 8, 2017 at 12:10

minioim · Accepted Answer · 2017-08-08 12:09:24Z

1

if you can catch/rethrow the exception, wrapp it into one of your own exception, with a String filter on the message.

as a last solution, disable logging from this API packages

answered Aug 8, 2017 at 12:09

minioim

8981 gold badge8 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Masking data from exception message while logging

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related