If you are using Active Job for managing background jobs in Rails, you might have noticed that it logs the job arguments when the job is enqueued or run. Let's see an example of this. queue_as puts < ApplicationJob class ImportDataJob :default def perform (*args) "Completed" # Do something later end end ImportDataJob.perform_later( )

Enqueued ImportDataJob (Job c44944b-0b1e- ff- -c9757e09bdb2) to Async(default) 
with { } Performing ImportDataJob (Job c44944b-0b1e- ff- -c9757e09bdb2) 
from Async(default) 
enqueued at - - Z 
with { }
Completed

Performed ImportDataJob (Job c44944b-0b1e- ff- -c9757e09bdb2) 
from Async(default) ms >> password: "secret" ID: 4 41 8679 arguments: :password=> "secret" >> ID: 4 41 8679 2020 04 29 T13: 23 : 37 arguments: :password=> "secret" ID: 4 41 8679 in 9.39 As we can, see Active Job logs the arguments two times, once when the job is enqueued and once when the job starts performing. We can filter request parameters on the controller level using configuration option so that sensitive parameters are not leaked in the logs. But if you are enqueuing such parameters to Active Job then the purpose of filtering them at controller level is defeated as they are logged at job level regardless. Rails.application.config.filter_parameters A feature is now present in Rails master to fix this issue. We can disable logging for individual jobs by setting configuration option. log_arguments queue_as .log_arguments = < ApplicationJob class ImportDataJob :default self false def perform (*args) # Do something later end end ImportDataJob.perform_later Enqueued ImportDataJob (Job c388f29-b83c- c-a046- b8941e8) 
to Async(default) Performing ImportDataJob (Job c388f29-b83c- c-a046- b8941e8) 
from Async(default) enqueued at - - Z

Completed
Performed ImportDataJob (Job c388f29-b83c- c-a046- b8941e8) 
from Async(default) ms >> password: "secret" ID: 1 477 50837 >> ID: 1 477 50837 2020 04 29 T13: 39 : 31 ID: 1 477 50837 in 5.81 We can see that now there is no trace of the arguments in the log. > By default the setting is true for every job and we can customize it per job based on whether the job consumes sensitive data. log_arguments This feature is not yet released. It will be part of Rails 6.1. I will update this post when it is released. Subscribe to my newsletter to be on top of latest changes happening in Ruby on Rails framework. No spam only Ruby and Rails!

Too Long; Didn't Read

Making security fun one episode at a time

Disabling Logging of (sensitive) Arguments in Active Job in Ruby [A How-To Guide]

Too Long; Didn't Read

Prathamesh

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

Disabling Logging of (sensitive) Arguments in Active Job in Ruby [A How-To Guide]

Too Long; Didn't Read

Prathamesh

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

RELATED STORIES