biscuit-rust icon indicating copy to clipboard operation
biscuit-rust copied to clipboard

Consider removing Debug trait on Biscuit

Open outscale-fba opened this issue 1 year ago • 0 comments

Debug & Display Trait are very verbose by default.

This can easily lead to leaks of biscuit content in logs, for example if a biscuit is passed to an instrumented function with the tracing crate.

For example:

#[tracing::instrument]
pub fn handler(biscuit: Biscuit) { ... }

will include the biscuit debug output in the traces & logs.

Note: This can be avoided by ignoring the biscuit using #[tracing::instrument(skip(biscuit))], but this is quite fragile (easy to forget the skip option). Note: Display impl was introduced by #117

outscale-fba avatar Dec 04 '24 08:12 outscale-fba