Prevent verbose HTTP request logging
Help prevent access to sensitive information by reducing verbose HTTP request logging.
The two properties glide.outbound_http_log.override and glide.outbound_http_log.override.level work together to control the level of logging for outbound HTTP requests. When glide.outbound_http_log.override is set to true, the log level for requests and responses is controlled by glide.outbound_http_log.override.level. If the override level is set to all or elevated, then request and response headers are logged.
Ensure that glide.outbound_http_log.override is not set to true and that glide.outbound_http_log.override.level is not set to all or elevated. If these properties do not appear in the System Properties [sys_properties table], they are in a secure state.
More information
| Attribute | Description |
|---|---|
| Configuration name |
|
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | - Boolean - String |
| Recommended value | - false - basic |
| Default value | - false - <blank> |
| Fallback value | - false - <blank> |
| Category | Error handling and logging |
| Security risk | - Severity score: 5.0 - CVSS rating: Medium - Security risk details: The headers logged through verbose settings for these properties can include sensitive information such as Authorization headers or cookies which can be used like credentials to access the requested resource. Any user who has access to the Outbound HTTP Logs table \(sys\_outbound\_http\_log\) can view this information changing their scope of access. The severity would depend on what type of outbound requests are made. |
| Functional impact | The glide.outbound_http_log.override system property enables you to override outbound http request log level. A value of false defaults the log level to basic. If glide.outbound_http_log.override is set to true, the level of logging is determined by the value of the glide.outbound_http_log.override.level property. This value can be basic, elevated, or all. All 3 are string/text based values. Any value other than these is interpreted as basic. For additional details, see Configure outbound logging. |
| Dependencies and prerequisites | None |
To learn more about adding or creating a system property, see Add a system property.
Parent Topic:Error handling and logging