在带有MVC 3的ELMAH中，如何从错误日志中隐藏敏感的表单数据? [英] In ELMAH with MVC 3, How can I hide sensitive form data from the error log?

问题描述

这是场景...

用户键入他的用户名.输入一个不正确"的密码. 用户名和密码值都将传递到Elmah错误日志 通过Exception.Context.Request.Form["Password"]. 这是一个只读值，无法修改.

User types his username. Types an "incorrect" password. Both username and password values are being passed to the Elmah error log via the Exception.Context.Request.Form["Password"]. It's a read-only value and cannot be modified.

不，我不希望忽略该异常(失败).我们以编程方式添加了ErrorLog过滤功能:

And no... I don't want to dismiss the exception (fail). We added ErrorLog Filtering programmatically:

void ErrorLog_Filtering(object sender, ExceptionFilterEventArgs e)
{
  if (e.Exception is LogOnException)
  {
    ((HttpContext) e.Context).Request.Form.Remove("Password");
    // This is what we want to do, but we can't because it is read-only
  }
}

但是无法修改Request.Form，以便在错误日志中隐藏密码.

But cannot modify the Request.Form so that the password is hidden from our error log.

有人遇到过这种方法吗?

Anybody ever encountered a way around this?

我基本上希望所有错误数据都没有密码字段.我们考虑过手动记录它，但是与简单地隐藏敏感数据相比，这似乎要花很多功夫.

I basically want all the error data without the password field. We considered logging it manually but that seemed to be a lot of work compared to simply hiding the sensitive data.

干杯们.预先感谢.

推荐答案

您不能根据请求修改表单集合，但是可以根据Elmah错误非等距修改表单集合，然后手动对其进行日志记录. IE.

You can't modify the form collection on the request but you can modify the form collection on an Elmah Error isntance and then manually log it. I.e.

public static class ElmahSensitiveDataFilter
{
  public static void Apply(ExceptionFilterEventArgs e, HttpContext ctx)
  {
    var sensitiveFormData = ctx.Request.Form.AllKeys
            .Where(key => key.Equals("password", StringComparison.OrdinalIgnoreCase)).ToList();
    if (sensitiveFormData.Count == 0)
    {
      return;
    }
    var error = new Error(e.Exception, ctx);
    sensitiveFormData.ForEach(k => error.Form.Set(k, "*****"));
    Elmah.ErrorLog.GetDefault(null).Log(error);
    e.Dismiss();
  }
}

然后在Global.asax中

Then in Global.asax

void ErrorLog_Filtering(object sender, ExceptionFilterEventArgs e)
{
    var ctx = e.Context as HttpContext;
    if(ctx == null)
    {
      return;
    }
    ElmahSensitiveDataFilter.Apply(e, ctx);
}

这篇关于在带有MVC 3的ELMAH中，如何从错误日志中隐藏敏感的表单数据?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！