Log management is an important topic, especially for the security of a web application, to ensure user activity, including potential attackers, is
recorded and available for an analyst to understand what’s happened on the web application in case of malicious activities.
Retention of specific logs for a defined period of time is often necessary to comply with regulations such as GDPR, PCI DSS and others. However, to protect user’s
privacy, certain informations are forbidden or strongly discouraged from being logged, such as user passwords or credit card numbers, which obviously
should not be stored or at least not in clear text.
Ask Yourself Whether
In a production environment:
- The web application uses confidential information and logs a significant amount of data.
- Logs are externalized to SIEM or Big Data repositories.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
Loggers should be configured with a list of confidential, personal information that will be hidden/masked or removed from logs.
Sensitive Code Example
With Signale log management framework the code is sensitive when an empty list of secrets is
defined:
const { Signale } = require('signale');
const CREDIT_CARD_NUMBERS = fetchFromWebForm()
// here we suppose the credit card numbers are retrieved somewhere and CREDIT_CARD_NUMBERS looks like ["1234-5678-0000-9999", "1234-5678-0000-8888"]; for instance
const options = {
secrets: [] // empty list of secrets
};
const logger = new Signale(options); // Sensitive
CREDIT_CARD_NUMBERS.forEach(function(CREDIT_CARD_NUMBER) {
logger.log('The customer ordered products with the credit card number = %s', CREDIT_CARD_NUMBER);
});
Compliant Solution
With Signale log management framework it is possible to define a list of secrets that will be
hidden in logs:
const { Signale } = require('signale');
const CREDIT_CARD_NUMBERS = fetchFromWebForm()
// here we suppose the credit card numbers are retrieved somewhere and CREDIT_CARD_NUMBERS looks like ["1234-5678-0000-9999", "1234-5678-0000-8888"]; for instance
const options = {
secrets: ["([0-9]{4}-?)+"]
};
const logger = new Signale(options); // Compliant
CREDIT_CARD_NUMBERS.forEach(function(CREDIT_CARD_NUMBER) {
logger.log('The customer ordered products with the credit card number = %s', CREDIT_CARD_NUMBER);
});
See
