Feature to prevent accidental logging of sensitive fields? #993
Labels
Comments
|
On a related note, does it make the most sense to have something like this live in the encoder impls {source}? |
|
My understanding is that Zap is a structured logging library. Therefore, |
|
It's probably not reasonable for Zap to support any "contextual" understanding of the data in fields that will be logged. Instead, callers should do any scrubbing prior to adding that data to a It's possible that we could add "field preprocessors" that invoke a UDF prior to encoding (which would still require users to define that scrubbing logic themselves), but we don't have any plans for this at the moment. I'll keep this open to track. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When using
.AnyI sometimes noticed reviewing/writing code that large structs are logged for debugging purposes but they might contain sensitive fields (that shouldn't be logged).Was wondering if fields augmented with a
sensitiveordonotlogtag could be obfuscated with maybe***or omitted when logging.When logging individual fields its more likely that the developer notices a field is a
tokenor apasswordand does not log it, but when using.Anyit happens sometimes.The text was updated successfully, but these errors were encountered: