Password as argument displayed in stack-trace

Question

We log all the exception that occurs in our code, with the stack-trace associated.

The problem comes from this function:

public function Authenticate($user, $password)
    //Authenticate the user
}

When an exception is thrown by this function, the stack-trace contains the parameters used: the user password is displayed in plain text.

How can I deal with that? Should I rewrite Authenticate function to accept only encrypted password? Can I disallow this particular parameter to be displayed in stack trace?

Any idea is welcome.

EDIT

I use the getTraceAsString function to log the trace.

Answer 1

You could use Exception::getTrace() method to collect information, and write your own custom getTraceAsString(), not including parameters.

See this example from the comments on Exception::getTrace() docs.

  function MakePrettyException(Exception $e) {
    $trace = $e->getTrace();

    $result = 'Exception: "';
    $result .= $e->getMessage();
    $result .= '" @ ';
    if($trace[0]['class'] != '') {
      $result .= $trace[0]['class'];
      $result .= '->';
    }
    $result .= $trace[0]['function'];
    $result .= '();<br />';

    return $result;
  }

Answer 2

Two things I would suggest:

1. The stack trace should not be visible on the client end (if not already)

2. Authenticate should only accept a hashed version of the password

That way, even if someone has a copy of the hashed password, they can't use it to login, or use it to reverse the password.

The ideal method of course would be to use something like Xdebug, where the default setting of collect_params is 0, meaning variables are not shown on the stack trace.