Leaking authenticity_token in logs

[0x01]

Is there a danger in leaking authenticity_token in logs? To put it differently: should I filter them out from logs?

[Joe Guerra]

Where are your logs located?

[0x01]

I do use Heroku and pipe logs to Papertrail (log aggregation service). Also, logs are stored in Amazon S3 for some time.

If these logs get compromised, can these tokens be used again (i.e. are these tokens reusable?)

Thanks.

пятница, 15 марта 2019 г., 23:08:48 UTC+4 пользователь Joe Guerra написал:

[Rob Zolkos]

It varies on each request   https://medium.com/rubyinside/a-deep-dive-into-csrf-protection-in-rails-19fa0a42c0ef

--
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rubyonrails-ta...@googlegroups.com.
To post to this group, send email to rubyonra...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/rubyonrails-talk/e8137c7f-e3c8-4fe8-8115-4c290ae68dc1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Walter Lee Davis]

They are only valid for 15 minutes and then they are never going to work again. They don't matter. I suppose if you had enough of them you could brute-force out what the secret key was, but that's a nation-state level of effort. Are your users (or their haters) in that league?

Walter