fix(soap): remove logging of soap request and response #3848
Conversation
mathias-vandaele
force-pushed
the
965-soap-connector-is-logging-sensitive-information
branch
from
ea53aaf to
0ce52ff
Compare
| @@ -138,7 +138,6 @@ private ClientInterceptor[] buildInterceptors( | |||
| List<ClientInterceptor> interceptorList = new ArrayList<>(); | |||
| handleAuthentication(authentication).ifPresent(interceptorList::add); | |||
| handleSoapHeader(soapHeader, namespaces).ifPresent(interceptorList::add); | |||
| interceptorList.add(new LoggingInterceptor()); | |||
There was a problem hiding this comment.
If I understand correctly, the customer does not want sensitive information to be logged.
However, the logging interceptor only uses the log level DEBUG, so the actual problem is on the customer side. I would vote for keeping this logging so that the debugging of connector issues is possible with the log.
There was a problem hiding this comment.
Log/store PII is also forbidden (GDPR etc.), which might happen if we keep this line. Regardless of the log level, we just can't store this information.
You might be right, but I just wanted confirmation here.
There was a problem hiding this comment.
You are right in general.
In the last days, I worked with a customer on an issue and we required spring security filter details to be logged.
Spring solves this like this:
- All logging is TRACE
- There is a parameter that you have to set so that the logging will happen.
If we introduce a parameter, we can ensure that no confidential stuff will be logged "by mistake". Also, we are aligned with industry standards then.
This is pretty much what @mathias-vandaele suggested in the first place, so sorry for re-iterating
There was a problem hiding this comment.
All logging is TRACE
There is a parameter that you have to set so that the logging will happen.
Yea, I get this part :D But we can still log PII (using TRACE), which is from my knowledge simply forbidden (trace or info is not relevant).
I might be wrong though, so feel free to ignore my comment.
There was a problem hiding this comment.
Well, apache http logs everything when being set to log level debug, so it is not forbidden :)
From my experience, the operations team has to ensure that they run compliant.
mathias-vandaele
force-pushed
the
965-soap-connector-is-logging-sensitive-information
branch
from
0ce52ff to
124ff7b
Compare
mathias-vandaele
force-pushed
the
965-soap-connector-is-logging-sensitive-information
branch
from
124ff7b to
881c6ad
Compare
mathias-vandaele
deleted the
965-soap-connector-is-logging-sensitive-information
branch
Description
Remove logs that could be showing sensitive data (request, response)
Related issues
closes #https://github.com/camunda/team-connectors/issues/965
Checklist
no milestonelabel.