OWSAP ESAPI logging support in logback in spring boot

Question

Is there OWSAP ESAPI logging supported in logback for spring boot application? I did a lot of research but could not find much on this. I found out that org.owasp.esapi now supports this after this PR . But this means that I will have to do away with logback. Is there a way that I can implement OWSAP ESAPI logging using logback? We are using slf4j logger that logback provides.

I looked at logback's maven page and there has not been any major release since 2017. So I am guessing that logback does not supports OWSAP ESAPI logging. Please correct me if I am wrong. If that is the case are there any alternatives I can use?

Also according to this spring-boot does not support slf4j 1.8 and above.If that is the case are there any alternatives I can use?

Answer 1

I found out that org.owasp.esap actually delegates the actual logging to our existing infrastructure. So all I had to do is add the correct package and it automatically takes care of the logging via whatever config I have in logback.

Add the esapi dependency to pom.xml

<dependency>
        <groupId>org.owasp.esapi</groupId>
        <artifactId>esapi</artifactId>
        <version>2.2.0.0</version>
</dependency>

Add the ESAPI.properties file to src/main/resources/ . This file contains the config properties for the ESAPI logger. Since I was using Slf4j looger, I set ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory in the file.

Now we can use the ESAPI logger for logging which internally will use the Slf4j logger. As the function definition of the ESAPI logger has an extra argument I had to update all the logger functions accordingly.

Answer 2

For me, the solution was:

1. Add the next code to my pom.xml

    <dependency> <groupId>org.owasp.esapi</groupId> <artifactId>esapi</artifactId> <version>2.2.0.0</version> </dependency>

2. Add ESAPI.properties and validation.properties files to src/main/resources/ , I took them from this post , of Vaquar Khan answer .

3. Update the property ESAPI.Logger in the file ESAPI.properties with this code of AshwinSreekumar :

    ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory

I hope it will help you, because in my case, I had to do some extra steps to make it work.