Cleaning sensitive data

TheLogfireSDK scans and edits potentially sensitive data from logs and spans before exporting them.

Disable cleanup

To disable cleanup completely, set [scrubbing ][logfire.configure(scrubbing)] to False:

import logfire

logfire.configure(scrubbing=False)

Use custom modes for more cleanup

By default, the SDK looks for some sensitive regular expressions. To add your own patterns, set extra_patterns to add to the list of regular expression strings:

import logfire

logfire.configure(scrubbing=logfire.ScrubbingOptions(extra_patterns=['my_pattern']))

logfire.info('Hello', data={
    'key_matching_my_pattern': 'This string will be redacted because its key matches',
    'other_key': 'This string will also be redacted because it matches MY_PATTERN case-insensitively',
    'password': 'This will be redacted because custom patterns are combined with the default patterns',
})

The following is the default cleanup mode:

'password'， 'passwd'， 'mysql_pwd'， 'secret'， 'auth'， 'credential'， 'private[._ -]？key'， 'api[._ -]？key'， 'session'， 'cookie'， 'csrf'， 'xsrf'， 'jwt'， 'ssn'， 'social[._ -]？security'， 'credit[._ -]？card'

Use callbacks to reduce cleanup

On the other hand, if the cleanup is aggressive, you can pass the function to callback To prevent certain data from being edited.

This function is called for each potential match the scrubber finds. If None is returned, the value is edited. Otherwise, the returned value replaces the matching value. This function accepts logfire.ScrubMatch .

Here is an example:

import logfire

def scrubbing_callback(match: logfire.ScrubMatch):
    # 'my_safe_value' 通常包含字符串 'password'，但它实际上并不敏感。
    if match.path == ('attributes', 'my_safe_value') and match.pattern_match.group(0) == 'password':
        # 返回原始值，防止脱敏。
        return match.value

logfire.configure(scrubbing=logfire.ScrubbingOptions(callback=scrubbing_callback))

safety tips

Using Message Templates

The complete span/log message is not cleaned, only the fields are cleaned. For example, the following:

logfire.info ('user details:{user}', user=User(id=123, password ='secret '))

... may record the following:

User details: [Cleaned due to password]

... but this:

user = User(id=123， password='secret')
logfire.info ('User details: ' + str(user))

It will be recorded:

User details: User(id=123, password='secret')

This is necessary so that security messages such as "password correct" are not completely edited.

if you enable inspect_arguments(default in Python 3.11+) and works, use the f string (for example logfire.info(f'User details： {user}'))) is safe.。For more information, see here。

In short, don't format messages yourself. For other reasons, this is usually good practice as well.

Excluding sensitive data from URLs

The “http.url” attribute recorded in the OpenTelemetry instrumentation library is considered safe, so URLs like 像“http://example.com/users/123/authenticate” are not edited.

As a general rule, not only for Logfire, it is assumed that the URL(including query parameters) will be recorded, so sensitive data should be placed in the request body or header.

Using parameterized database queries

The “db.statement” attribute recorded in the OpenTelemetry database tool library is considered safe and therefore SQL queries such as 像 “SELECT secret_value FROM table WHERE ..."are not edited.

Use parameterized queries (such as prepared statements) so that sensitive data is not inserted directly into the query string, even if the interpolation method you use is unaffected by SQL injection.

---

本文总阅读量次