We know that Craft logs the $_POST variable in web.log. I wonder if we have some sensitive data going through the server side (collected from a front end form), even if we don't save it in the database, it can still potentially end up in Craft's logs, isn't it? E.g. when there's an error during the form submission.

Is there any ways which we could avoid saving the $_POST variable in the log, just for certain URLs?

  • 1
    You will only see those if you have 'devMode' => true, in your config/general.php
    – Oli
    Feb 27 '20 at 9:17

As Oli commented, those will only be logged if devMode is enabled, which should never be the case in production.

Outside of that, Craft does have a sensitiveKeywords propery in the Security class: https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29 that defaults to these keywords: https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29 and will redact those from places like log files.

If you need to modify that list, you can do so from by extending the application config like so:

return [
    'components' => [
        'security' => [
            'class' => craft\services\Security::class,
            'sensitiveKeywords' => [
  • Thanks for clarifying, Oli and Brad, and that's a very useful tip regarding the sensitiveKeywords.
    – Wei
    Feb 28 '20 at 5:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.