ruby-on-rails - 禁止在 Ruby on Rails 中记录某些参数

Question

我注意到，每当 Ruby on Rails 中的任何 Controller 执行任何操作时，某些日志都会自动写入日志文件，例如:

Processing by CasesController#update as HTML

Parameters: {"utf8"=>"✓", 
"authenticity_token"=>"XAAgI8MGxIIyqcBTUqtHvqjechgNHqxKLtZAVIaceZSuhEskQA6i2mjbItbbruabPMPWGM8AXKDWNdnqJRCGBw==",
"versionId"=>"9",
"type"=>"case", 
"queue"=>"filing", 
"disposition"=>"Filed",
 "assignee"=>"abc",
 "decisionDate"=>"2020-05-19",
 "filingDate"=>"2020-05-19",
  "accounts"=>[{"lineOfBusiness"=>"ACCS",
  "obfuscatedMerchantId"=>"A1JLF6PVG3MPCN", 
  "fpsAccountId"=>"",
  "productAccountId"=>"",
  "includeInInvestigation"=>"yes",
  "includeInFiling"=>"yes"}],
  "relatedItems"=>[{"itemType"=>"OBSERVATION_ID",
  "itemValue"=>"RI:1-MPI:1-PI:4839201-JI:10334165-RRD:13-MAY-20-EQR:Rule_ACCS_SAM_MultiACCSBankAccounts-CID:A1JLF6PVG3MPCN"},
 {"itemType"=>"IWB_TASK_ID", "itemValue"=>"7017140401"}],
 "button"=>"", "id"=>"cab90a9e-78e9-6d58-c5c8-c4b3424d0751"}

我想避免记录某些敏感参数，例如我想避免记录 versionId。我怎样才能做到这一点？

Answer 1

您可以通过将敏感参数添加到 config.filter_parameters 来排除日志记录，如官方 Rails Guides 中所述:

config.filter_parameters used for filtering out the parameters that you don't want shown in the logs, such as passwords or credit card numbers. It also filters out sensitive values of database columns when call #inspect on an Active Record object. By default, Rails filters out passwords by adding Rails.application.config.filter_parameters += [:password] in config/initializers/filter_parameter_logging.rb. Parameters filter works by partial matching regular expression.