4

In an Asp.Net Web API 2 project, We're logging every http request and response with log4Net.

Some controllers have critical parameters such as "CreditCard, CVV, Month, Year" etc. This data should not be stored in a database.

I don't know how to check for these. Should I use a RegEx? Or should I hide the controller method's log which contains the critical parameters which must not be stored?

Improve this question
4
  • 9
    Why are you seeing this instead of your payment processor, is a question you ought to ask yourself.
    – Lars Viklund
    Mar 17, 2016 at 14:13
  • 3
    It's hard to say without knowing how you log. log4net offers filtering facilities, so if you are logging your requests in some structured fashion where you have easy access to all parts of the request, you can make sure to filter out sensitive request parameters. That would, however, require that those parameters always have the same names.
    – Nicos
    Mar 17, 2016 at 14:39
  • 1
    logging everything like this is v bad and probably breaks several laws
    – Ewan
    Mar 17, 2016 at 18:07
  • 2
    The fact that you are handling this information in a way that lets it be logged at all means you're probably violating laws.
    – Daenyth
    Mar 17, 2016 at 18:55

2 Answers 2

Reset to default
7

"We're logging every http request and response with log4Net."

Although im sure this is very useful for developers, its very bad practice and is potentialy illegal.

As you have pointed out you are probably saving credit card information in a non pci compliant way.

You are probably also processing 'personal information' such as names and addresses etc in ways which the owner has not given you permission to do so. Breaking the data protection act or equivilant law in your country.

You may also be saving your users usernames and passwords in clear text

The solution is simple to say but hard to implement. You have to stop logging every request/response and start controlling the exact message which is written to your logs.

Eg.

Instead of

Log.Write("Error processing request" + request.ToString());

you have Catch the exact error and write

...
   DoStuff(publicA,secret1,secret2)
}
catch(Exception ex)
{
    Log.Write("Error doing stuff with id : " + publicA);
}

Where you know publicA is some internal db reference or identifier with no meaning to a hacker and can prove it to your security auditor.

To clarify: Neither hiding the logs, having a blacklist of parameters or using a regex to spot and remove secret data really helps you. As you can't be sure that you have caught every case.

Improve this answer
2
  • 1
    OK, we get it; you disapprove of the practice. The rest of your answer seems to be restating what the OP already said in his question: "You have to stop logging every request/response and start controlling the exact message which is written to your logs." That's the problem he's trying to solve.
    – Robert Harvey
    Mar 17, 2016 at 18:32
  • Clarification added.
    – Ewan
    Mar 17, 2016 at 18:36
2

@LarsViklund nailed the answer in a comment. Unless you're a payment processor, credit card information should never reach your servers at all.

You need to fix the real problem and not try to mask it by making exceptions to your logging practices.

Tell your business leaders that hackers will never get your client's data if you never had it to begin with. Explain to them that they're very likely breaking a lot of privacy laws as well as PCI compliance - which can lead to some very large fines.

Improve this answer
3
  • 2
    How does not actually dealing with the problem at hand justify making that an actual answer? It's nice that you live in a world where you can easily offload all responsibility to third parties, but that's not always possible.
    – Nicos
    Mar 17, 2016 at 14:40
  • 2
    @Nicos is right. In a super world or normal condition, I should not need to store any credit card information. But If we comes the real world, we're using very mixed distributed system. WEB-UI calls the Web API. Web API calls different WCF services. Then finally WCF services reaches the VPOS. So I need the log all request and responses to know what's going on about the system.
    – ozkank
    Mar 17, 2016 at 14:51
  • 3
    What if they are a payment processor!!
    – Ewan
    Mar 17, 2016 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.