swift-server / swift-server/async-http-client
Privacy & security: Clarify what we log at which log level
Nobody has claimed this yet.
- Dominant language
- Swift
- Stars
- 1.1k
- Forks
- 156
- PR merge metrics
- No merged PRs in 30d
Description
IIRC the initial design that we don't log anything private like URL, headers or even bytes at all. That might be a little strict though.
But it's very important to clarify what level we're potentially logging sensitive things at and if there's configuration to change so.
Right now it seems that we're logging the actual bytes of HTTP traffic without even documenting that. I think this needs to be clarified.
My personal opinion:
- Nothing sensitive (i.e. no URLs/headers/bytes/...) logged at debug
- URLs (but not headers/bytes) fine to log at trace
Very happy to change my opinion but this needs clarification.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the HTTP traffic logging behavior and any configuration that controls log levels, since no files or tests are named in the issue. Compare actual logging of URLs, headers, and bytes with the project's intended privacy policy, then document the agreed levels and configuration once the open design question is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- observability, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100