Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

1
  • 1
    Logging sensitive information can be a problem, true. How severe this is, depends on the threat model. Generally speaking, an employee visioning the logs can impersonate any logged user, and this is bad. Unless the threat model allows that. You can mitigate this by making the app log what's actually needed for the debug sessions, eventually masking sensitive values. Maybe you can even set an higher logging level for the specific class that's dumping the headers. The only way to mitigate this would be to restrict access to the logs, which would be detrimental. Commented Jan 29 at 15:27