Exception notification & data security

rubyonrails-talk
1

I was about to use the exception_notification plugin, and then I realized that the information it sends out could include user data (as a part of the exception message) which in my application is something we need to be careful about. I think that for my needs, an ideal notification system would send out a very basic message with minimal content, and then store all the detailed error report information in the database for reference. That way the potentially sensitive information would not travel through the email system and onto potentially unsecured computers.

I think it would not be hard to implement that, but... is there already a plugin that can handle that?

Thanks,      --Paul

p.s. I do realize that exception_notification lets you configure the email message, but I do want the information it includes by default-- just not in the email message itself.

2

I was about to use the exception_notification plugin, and then I realized that the information it sends out could include user data (as a part of the exception message) which in my application is something we need to be careful about. I think that for my needs, an ideal notification system would send out a very basic message with minimal content, and then store all the detailed error report information in the database for reference. That way the potentially sensitive information would not travel through the email system and onto potentially unsecured computers.

I think it would not be hard to implement that, but... is there already a plugin that can handle that?

Thanks,     --Paul

p.s. I do realize that exception_notification lets you configure the email message, but I do want the information it includes by default-- just not in the email message itself.

You could rip that plugin apart and have it log it instead of email it. Or you could have it send the email to an address that resides on the server itself, then use something else (procmail?) to send a short and sweet message to notify you to go look at it....

There's also hoptoad_notifier. There's an online component to it. I have no idea if you can have it deliver the messages (it's over http) to an internal server or not... I haven't seen any others that are "local/internal"...

-philip

3

just a couple of days ago i posted a similar q, post was titled:

what is best practice for record::notfound?

the guy who answered snipped in some code. have a look

regs