Logged secrets when :client-id is nil

[NoahTheDuke]

Hey Peter!

We use Integrant to do state management and use middleware to attach the subsystems to each request: (-> req (assoc :system/db (:db system)) ...). Occasionally, there's a faulty connection (hard to tell exactly why or how, we're still diving into a related issue) and the :client-id is nil, which trips the line below. This logs the gigantic request to our logs, which includes things like production secrets that are stored in memory only.

Would it be possible to add a flag or some configuration to allow us to avoid logging in this case? We're already dealing with the thrown exception and can log a redacted form of the request as desired.

sente/src/taoensso/sente.cljc

Line 752 in b746080

(timbre/errorf (str err-msg ": %s") ring-req) ; Careful re: % in req

[ptaoussanis]

@NoahTheDuke Hi Noah!

Thanks for the clear description of the problem, that was very helpful 🙏

I definitely consider this a bug, there's no need to print the full Ring request here - and the risk is better avoided.

I've just pushed v1.19.2 to Clojars that removes the logging of Ring requests on this error.

Sorry about the trouble!

Cheers :-)

[NoahTheDuke]

Damn, that's so quick! Thank you!