How to mask passwords in logs?

Question

What is the best approach to hide confidental data, e.g. passwords into logs.

I would like to log body of POST requests, which are send to my Servlet. But logging password isn't a good idea. How to mask passwords? If the regular expression is the best idea, can you propose some examples?

// Example:
password=123456asedqwe -> password=***
bla&password=qweqweqwe -> bla&password=***
password=qweqweqwe&qwe=qwe -> password=***&qwe=qwe

Answer 1

You can try the following simple regex replacement. It assumes that the password lies between password= and the next &.

    String s = "password=qweqweqwe&qwe=qwe ";
    String maskedPassword = s.replaceAll("password=[^&]*", "password=***");
    System.out.println(maskedPassword);

prints:

password=***&qwe=qwe