Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set RequestLog#content for AnnotatedService if a pojo is requested/returned #5711

Open
jrhee17 opened this issue May 31, 2024 · 0 comments
Open
Milestone

Comments

@jrhee17
Copy link
Contributor

jrhee17 commented May 31, 2024

Logging[Client|Service] can be confusing since the request/response content is sometimes logged, and sometimes not logged.

Request/Responses are logged when:

  • GrpcService or ThriftService is used
  • ContentPreviewing[Client|Service] is used

The majority of our users use AnnotatedService along with GrpcService or ThriftService.
However, when adding a Logging[Client|Service] to APIs, it may be surprising that some services log content by default while others don't.

In most cases, this isn't a big problem. However, we recently saw a case where a service handling sensitive data used AnnotatedService and intentionally didn't add a ContentPreviewing[Client|Service]. While adopting GrpcService, they found that sensitive information was being logged by default.

I believe if we just log content for AnnotatedService by default as well, users can be aware that content will be left in most cases and configure Logging[Client|Service] accordingly. As an added bonus, by leaving the POJO at RequestLog#content we may potentially also allow users to sanitize specific fields more easily.

@jrhee17 jrhee17 added this to the 1.30.0 milestone May 31, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant