WCF调试记录敏感信息

Question

I am looking into the security implications of having debug logging enabled within WCF, in particular what information it can/will log and whether there are any configurations that can be done to mitigate it.

Say if we create a DataContract with a Password property that is part of WCF operation, I need to know if the property will be written out in clear text when logging is turned on for requests and responses and whether a service exception at any of the layers would expose any of this.

Other considerations are around can SSL or message encrpytion prevent this logging or any special binding configuarations, behaviours or hooks use to intercept and possibly clean the logs.

The reason is that the client needs the logs written to disk not to contain their customer passwords as less secure people in the company might read them.

Thanks

Answer 1

You have to differentiate MessageLogging and Tracing. Your sensitive data seems to be part of the message data. So when you turn on Message logging, you will see your sensitive data in clear text in your logs.

Tracing on the other hand is more about WCF infrastructural events. Content of your messages won't be logged there.

As well with exceptions raised by the WCF runtime: They will never contain any message data. By default exceptions raised to the client contain absolutely no information because of security considerations. You have to explicitly include the data you want to send to the client in an exception case.

Im not sure how to intercept the logging and tracing, but WCF is by all means very extendable, so i bet there is an extension point to inject your TracingBehavior somewhere to the framework.

Answer 2

I think you should create a custom listener for the PII information tracing- this a good article on some best practices (section: Logging Sensitive Information) - since it appears you are also using a WebHost. I believe regardless of SSL the PII will be written to the logs, but there are ways to prevent unauthorized access.