Skip to content

DefaultWebClient logging sensitive information in URI #29148

Closed
@itsnagaraj

Description

@itsnagaraj

Affects: v5.3.22 and prior. Module is spring-webflux

The insertCheckpoint method in DefaultWebClient seems to log the URI. In few scenarios this URI can have sensitive information like email or phone number or name etc.,. The framework doesn't provide any controls to switch it off and the only way I can think of right now is to create a duplicate of this class in our classpath and override this method. Any other suggestions are appreciated.? If future versions of spring-webflux can provide a way to override the behaviour that will provide us a strategic alternative.

private <T> Mono<T> insertCheckpoint(Mono<T> result, HttpStatusCode statusCode, HttpRequest request) {
	HttpMethod httpMethod = request.getMethod();
	URI uri = request.getURI();
	String description = statusCode + " from " + httpMethod + " " + uri + " [DefaultWebClient]";
       return result.checkpoint(description);
}


Metadata

Metadata

Assignees

Labels

in: webIssues in web modules (web, webmvc, webflux, websocket)type: bugA general bug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions