LogRedactor
in package
Builds non-identifying traces of personal data and secrets for operational logs.
Logs (Tracy channels eshop.general, company, tax, mail-blocked, ...) carry the event
type, error code and a correlation value, never a plaintext email, tax id, message subject
or signed token.
IMPORTANT: self::fingerprint() is pseudonymization, not anonymization. The unsalted hash only correlates two log lines about the same value, and a known value can be found by comparison. Do not use it for low-entropy secrets and never send it outside the operational log.
Table of Contents
Constants
- FINGERPRINT_LENGTH : int = 12
Methods
- fingerprint() : string
- Returns a short hash of the normalized value (trimmed, lowercase); the same value gives the same fingerprint.
- scrubMessage() : string
- Strips typical secrets from the message of an external library exception before it is written to the server log.
Constants
FINGERPRINT_LENGTH
private
int
FINGERPRINT_LENGTH
= 12
Methods
fingerprint()
Returns a short hash of the normalized value (trimmed, lowercase); the same value gives the same fingerprint.
public
static fingerprint(string $value) : string
Parameters
- $value : string
Return values
stringscrubMessage()
Strips typical secrets from the message of an external library exception before it is written to the server log.
public
static scrubMessage(string $message[, int $maxLength = 500 ]) : string
Covers URL query values, URL userinfo, Authorization/Bearer/Basic headers,
secret|token|password|key = value pairs and keys shaped like sk_live_....
IMPORTANT: best effort only, nothing guarantees that no secret remains. The exception text therefore belongs in the log only, never in a public response.
Parameters
- $message : string
- $maxLength : int = 500