Strip OAuth And Search Query Strings From Access Logs
Context
The default nginx access log records full request URLs and referrers. On TenCtrl, those URLs include the OAuth callback, whose query string carries a one-time authorization code and client information, and user searches, whose query string carries names or email addresses.
Decision
Use a dedicated nginx log format for TenCtrl that records the method, the path without its query string, the protocol, the status, the size and the request time, and no referrer.
Alternatives Considered
Keep the default combined log format
Pros
- Standard tooling understands it.
- Full URLs help debugging.
Cons
- Authorization codes and searched personal data land in log files and rotated archives.
Disable access logs for TenCtrl
Pros
- Nothing sensitive is written.
Cons
- Loses the request trail needed to diagnose errors and abuse.
Reasoning
The path, status and timing are enough to debug routing and performance. Query strings on these routes are either credentials in transit or personal data, and logs are kept, rotated and copied far longer than a request lives.