Mask Sensitive data in log messages in spring boot (2024)

2 min read

In Spring Boot, you can use various mechanisms to mask or obfuscate sensitive information in log messages. This is crucial for security and compliance reasons, especially when dealing with sensitive data like passwords, API keys, or personal information.

Mask Sensitive data in log messages in spring boot (2)

Here are some common approaches you can take to mask log messages in Spring Boot:

Slf4j MDC (Mapped Diagnostic Context): Slf4j MDC allows you to store contextual information for the duration of a thread. You can use it to store sensitive information temporarily and include it in log messages without logging the actual sensitive data.

Example:

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.slf4j.MDC;public class MyService {
 private static final Logger logger = LoggerFactory.getLogger(MyService.class);
 public void logSensitiveData(String sensitiveData) {
 MDC.put("sensitiveData", "****"); // Mask sensitive data
 logger.info("Sensitive data: {}", sensitiveData);
 MDC.remove("sensitiveData"); // Clean up
 }
}

2. Custom Log Appender or Layout: You can create a custom log appender or layout that processes log messages before they are written to the log files. Within this custom logic, you can mask or obfuscate sensitive information.

Example:

import ch.qos.logback.classic.PatternLayout;
import ch.qos.logback.classic.spi.ILoggingEvent;public class CustomPatternLayout extends PatternLayout {
 @Override
 public String doLayout(ILoggingEvent event) {
 String originalMessage = super.doLayout(event);
 String maskedMessage = maskSensitiveData(originalMessage);
 return maskedMessage;
 }
 private String maskSensitiveData(String message) {
 // Implement your custom logic to mask sensitive data
 // For example, replace occurrences of a pattern with "*"
 return message.replaceAll("password=\\w+", "password=*****");
 }
}

You would then configure this custom layout in your logback.xml or logback-spring.xml configuration.

3. Using Log Masking Libraries: There are third-party libraries and tools specifically designed for log masking, such as Logback Masking Layout or Slf4j Masking Layout. These libraries provide configurable masking strategies and make it easier to mask sensitive information in log messages.

Example (Slf4j Masking Layout):

<dependency>
 <groupId>com.github.lukas-krecan</groupId>
 <artifactId>slf4j-masking-layout</artifactId>
 <version>1.0.1</version>
</dependency>

Configure in logback.xml:

<layout class="net.logstash.logback.layout.LogstashLayout">
 <mask>
 <pattern>${password}</pattern>
 <pattern>${creditCard}</pattern>
 </mask>
</layout>

Choose the approach that best fits your application’s requirements and integrates well with your logging framework (e.g., Logback, Log4j). Keep in mind that logging sensitive information should be avoided whenever possible, and proper security practices should be followed. Always consider the security implications of logging and handle sensitive data with care.

Enjoy Learning.