PostgreSQL JDBC driver hide prepared statement parameters from logging

Question

I need to hide prepared statement parameters from logging debug level and exception message. There are security critical values. For example using pgp_sym_encrypt, when exception thrown from database, in exception message shown full statement with parameters also 2nd parameter encryption key password. Is there any way to hide these kind of values, especially in exception message?

Have you considered passing the encryption key as a parameterized value? — Mark Rotteveel
– Mark Rotteveel, Commented Dec 24, 2019 at 7:34

jjanes · Accepted Answer · 2019-12-24 16:17:02Z

1

The safest way is to do the encryption on the client side and never send the password to the database. Once you send it to the database, it will be very hard to absolutely control what happens to it. Consider that if there is a way to configure the database to suppress this logging, then there is also a way to reverse that configuration.

answered Dec 24, 2019 at 16:17

jjanes

44.9k5 gold badges39 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PostgreSQL JDBC driver hide prepared statement parameters from logging

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related