Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A short explanation of the proposed change:
As discussed in this routing-release issue I have provided logic to redact query parameters of GET requests from getting logged to the access log.
An explanation of the use cases your change solves
There are three options:
none
(default) retains the current behavior: All parameters are loggedall
Removes all query parameters from the loghash
performs a SHA1 over the query parameters and logs only the hash sum.Instructions to functionally test the behavior change using operator interfaces (BOSH manifest, logs, curl, and metrics)
Default behavior:
redact_query_parameters
tonone
bosh -d cf deploy
curl https://some-app.cf-app.com/?password=secret
bosh -d cf ssh gorouter
vi access_log
some-app.cf-app.com - [timestamp] "GET /?password=secret HTTP/1.1"
Log no query parameters:
redact_query_parameters
toall
bosh -d cf deploy
curl https://some-app.cf-app.com/?password=secret
bosh -d cf ssh gorouter
vi access_log
some-app.cf-app.com - [timestamp] "GET / HTTP/1.1"
Log only hash of query parameters:
redact_query_parameters
tohash
bosh -d cf deploy
curl https://some-app.cf-app.com/?password=secret
bosh -d cf ssh gorouter
vi access_log
some-app.cf-app.com - [timestamp] "GET /?hash=878830dc19ac17a15b189cad83b7809975bc525e HTTP/1.1"
Expected result after the change
GET query parameters are hidden or hashed if needed.
Current result before the change
GET query parameters are logged.
Links to any other associated PRs
tbd
I have viewed signed and have submitted the Contributor License Agreement
I have made this pull request to the
main
branchI have run all the unit tests using
scripts/run-unit-tests-in-docker
from routing-release.(Optional) I have run Routing Acceptance Tests and Routing Smoke Tests on bosh lite
(Optional) I have run CF Acceptance Tests on bosh lite