URL:
https://github.com/SSSD/sssd/pull/585
Title: #585: tcurl: do not log the payload
jhrozek commented:
"""
Thank you for working on the issue. The patch works, but I have some suggestions how to
improve the code.
First, the code is quite expensive. At the very least, it should only ever be called if a
high debug level is set.
But primarily I'm thinking that the tcurl module might not even be the right place to
sanitize the logs, because the tcurl module knows nothing about what goes through it. It
might even happen that some generic HTTP code would go through which would contain
"payload" and that would mess up the debugging.
So I'm actually wondering if the logging should happen primarily in the secrets KCM
back end where we could dump the JSON, but replace some items in the JSON.
About the logging in the tcurl module, I'm thinking it is still valuable for
developers, but we might only allow it if SSSD is compiled with some #define or some
environment variable is set.
What do you think?
"""
See the full comment at
https://github.com/SSSD/sssd/pull/585#issuecomment-393864147