The password in the logs
To debug a sign-in bug, your AI added a log line. Weeks later you open your hosting logs and see customers' passwords in plain text.
This answers: Is it dangerous to console.log request bodies? No coding needed. 3 quick decisions.
- Keeping data safe
- Keys and secrets
- Keeping it running
Checking your access…
Is it dangerous to console.log request bodies?
Yes. Logging a whole request body copies everything the user sent, including passwords and tokens, into your hosting logs, where teammates, log services and anyone with a stolen login can read it. Log what happened, such as a user id and outcome, never request bodies. If secrets reached the logs, delete them and protect affected users.
Breaks at Logs: Request body, password included, logged
Why AI tools write this bug
When debugging, AI tools add console.log of the full request to see what arrived, and the line stays in after the bug is fixed.
How to fix it
- Remove logs that print bodies, headers, tokens or passwords.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Doesn't my auth provider hash passwords anyway?
- It does in its database. A log line copies the plain password before it is hashed, into a place with different access.