Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[RFC] Add #[SensitiveParameter] attribute to password arguments across components #46853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
alexandre-daubois opened this issue Jul 5, 2022 · 2 comments

Comments

@alexandre-daubois
Copy link
Member

alexandre-daubois commented Jul 5, 2022

Description

A new attribute named #[SensitiveParameter] has been introduced in PHP 8.2 to prevent sensitive method arguments to leak in application logs, exceptions and backtraces. I think this would be great to add this attribute across the framework.

Here is the RFC: https://wiki.php.net/rfc/redact_parameters_in_back_traces
Human-readable RFC: https://php.watch/versions/8.2/backtrace-parameter-redaction
Here is the commit to php-src: php/php-src@9085197

I create this RFC to discuss if there is any contraindication to do this. You'll find a simple example below on how it would look like.

Example

Password credentials

namespace Symfony\Component\Security\Http\Authenticator\Passport\Credentials;

// ...

class PasswordCredentials implements CredentialsInterface
{
    // ...

    public function __construct(
        \[SensitiveParameter]
        string $password
    ) {
        $this->password = $password;
    }

    // ...
}

HttpOptions

namespace Symfony\Component\HttpClient;

// ...

class HttpOptions
{
    // ...

    public function setAuthBasic(
        string $user,
        #[\SensitiveParameter]
        string $password = ''
    ): static
    {
        $this->options['auth_basic'] = $user;

        if ('' !== $password) {
            $this->options['auth_basic'] .= ':'.$password;
        }

        return $this;
    }

    // ...
}
@alexandre-daubois alexandre-daubois changed the title Add #[SensitiveParameter] attribute to password arguments across components [RFC] Add #[SensitiveParameter] attribute to password arguments across components Jul 5, 2022
@chalasr
Copy link
Member

chalasr commented Jul 5, 2022

See #46183

@alexandre-daubois
Copy link
Member Author

My bad, thanks for the link! 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants