Skip to content

[codex] Remove sensitive request logging#290

Merged
jjoonleo merged 2 commits intomainfrom
feat/implement-issue-274
May 7, 2026
Merged

[codex] Remove sensitive request logging#290
jjoonleo merged 2 commits intomainfrom
feat/implement-issue-274

Conversation

@jjoonleo
Copy link
Copy Markdown
Contributor

@jjoonleo jjoonleo commented May 7, 2026

Summary

  • Replace raw controller request logging with metadata-only logs and request IDs.
  • Remove token, secret, OAuth credential, and sensitive exception-message logging.
  • Remove DTO string rendering and add a documented logging redaction policy.
  • Add a static regression test that fails on sensitive log terms, request-body logging, or DTO toString reintroduction.

Validation

  • ./gradlew test --tests devkor.ontime_back.security.SensitiveLoggingPolicyTest
  • ./gradlew test compiles, then is blocked by local MySQL/Flyway connectivity (CommunicationsException) in this workspace.

Closes #274

jjoonleo added 2 commits May 7, 2026 13:22
# Conflicts:
#	ontime-back/src/main/java/devkor/ontime_back/dto/FeedbackAddDto.java
#	ontime-back/src/main/java/devkor/ontime_back/global/jwt/JwtAuthenticationFilter.java
@jjoonleo jjoonleo marked this pull request as ready for review May 7, 2026 05:35
@jjoonleo jjoonleo merged commit dc73fed into main May 7, 2026
2 checks passed
@jjoonleo jjoonleo deleted the feat/implement-issue-274 branch May 7, 2026 05:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[P0] Remove token, secret, and raw request-body logging

1 participant