0
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

rails(graphq-ruby)に向けてパスワード等をqueryに乗せて送信するとログのparamsが[FILTERED]にならなくて丸見えになってしまうのをどうにかする

Posted at

環境

  • rails (5.2.3)
  • graphql-ruby (1.9.3)

前置き

Rails.application.config.filter_parameters += [/password/, :query]
とかにすれば隠せるのですが、queryが全て[FILTERED]になってしまうのも悲しい

これが

Parameters: {"query"=>"mutation { updateUserPassword(input: { id: \"1\", password: \"password\", passwordConfirmation: \"password\" }) { errors } }}"

こうなっちゃう

Parameters: {"query"=>[FILTERED]}

対処する

filter_parametersはlambdaを許容しているらしいのでqueryパラメータのときは自前で置換をすることにする

config/initializers/filter_parameter_logging.rb
graphqlQueryFilter = lambda do |k,v|
  return unless k.to_sym == :query
  v.replace v.gsub(/(password[a-zA-Z_]*:) \"([^\"]*)\"/) {
    "#{$1} \"#{ActionDispatch::Http::ParameterFilter::FILTERED}\""
  }
end

Rails.application.config.filter_parameters += [/password/, graphqlQueryFilter]

これでこんなかんじになりました

Parameters: {"query"=>"mutation { updateUserPassword(input: { id: \"1\", password: \"[FILTERED]\", passwordConfirmation: \"[FILTERED]\" }) { errors } }}"

ちなみに今回はclientのクエリを自前で生成していて文字列はダブルクオーテーションで囲むようにしているのでこれでOKでした、
ご自身の環境にあわせて正規表現部分に手を加えてください

0
1
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
0
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?