Nginx logs passwords in POST

Question

Nginx

Hey!

It costs nginx + passenger with default log settings. For some reason, data like this is stored in the logs:

[24/Feb/2012:10:07:59 +0000] "POST /users/authenticate.xml?login= korjik &owner_id=1&password= password HTTP/1.1"

Rummaged Google to get rid of from this. What do you advise?

Answer 1

Obviously because the passwords were not passed in the post body, but as uri arguments.

Answer 2

It is better to transmit hashed passwords in general, also with a salt inside.

Answer 3

Disable logging - an option?
wiki.nginx.org/NginxHttpLogModule#access_log
Or maybe changing the log format will do?
wiki.nginx.org/NginxHttpLogModule#log_format