allow config.action_controller.filter_parameter_logging in environment.rb

I really like it. +1

Personally, I'd like to see :password set by default to encourage it as a best-practice. (maybe :ssn, and :credit_card too, but those are less-common)

What are the benefits of doing it in environment.rb over application.rb ?

Thanks.

Sort of. +1 / -1.

Perhaps a middle ground that retains the utility would be a Boolean:

config.actioncontroller.filterparameter_logging = false

rather than the actual fields, which would look more like this:

config.actioncontroller.filterloggingofparameters :password, :ssn, ...

The only reason to have it on is for debugging, which is only done in development (or maybe test), so the finer-grained settings aren't really useful.

Gaius,

I definitely disagree. In production, it is more important as you are accepting real passwords, credit cards, and SSNs.

If you're storing credit card numbers, even in log files, you're probably violating your merchant agreements.

Let me clarify: I was envisioning augmenting the current system wherein fields are declared in the controllers.

That is:

app/controllers/application.rb:

class ApplicationController < ActionController::base
  filter_parameter_logging :password, :ssn, ...
  ...
end

config/environments/development.rb:

config.action_controller.filter_parameter_logging = false
# or even
config.action_controller.filter_parameter_logging = []

By default, the filtering would be on, leaving the Controllers to dictate the behavior.

Now I see your confusion, Daniel.

By "The only reason to have it on is for debugging," I clearly meant "The only reason to have it off is for debugging." [laughs at self being ridiculously bad at proof-reading]