arturobernalg commented on PR #943: URL: https://github.com/apache/tomcat/pull/943#issuecomment-6861524505
-1 I don't think this belongs in `ErrorReportValve`. Tomcat already provides request logging through `AccessLogValve`, while unhandled exceptions are logged elsewhere. More importantly, this change logs all request headers and the query string without filtering. I tested it with a running Tomcat instance and confirmed that Authorization credentials, session cookies and API keys are written to the logs in clear text. It also duplicates exception stack traces and logs ordinary 404 responses at SEVERE level. I don't think we should introduce this functionality in its current form. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
