Answers.Body: <p>As <a href="https://craftcms.stackexchange.com/questions/33782/avoid-saving-post-in-craft-logs-for-certain-urls#comment41078_33782">Oli</a> commented, those will only be logged if <code>devMode</code> is enabled, which should never be the case in production.</p>
  
  <p>Outside of that, Craft does have a <code>sensitiveKeywords</code> propery in the Security class: <a href="https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29" rel="nofollow noreferrer">https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29</a> that defaults to these keywords: <a href="https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29" rel="nofollow noreferrer">https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29</a> and will redact those from places like log files.</p>
  
  <p>If you need to modify that list, you can do so from by extending the <a href="https://docs.craftcms.com/v3/config/app.html#app" rel="nofollow noreferrer">application config</a> like so:</p>
  
  <pre><code>&lt;?php
  return [
      'components' =&gt; [
          'security' =&gt; [
              'class' =&gt; craft\services\Security::class,
              'sensitiveKeywords' =&gt; [
                  'key1',
                  'key2',
              ],
          ],
      ],
  ];
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-02-28T05:12:08.413Z
Answers.Text: Thanks for clarifying, Oli and Brad, and that's a very useful tip regarding the sensitiveKeywords.
Answers.UserDisplayName: Wei
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-02-27T23:49:04.720Z
Answers.LastActivityDate: 2020-02-27T23:49:04.720Z
Answers.UserDisplayName: Brad Bell
Body: <p>We know that Craft logs the $_POST variable in web.log. I wonder if we have some sensitive data going through the server side (collected from a front end form), even if we don't save it in the database, it can still potentially end up in Craft's logs, isn't it? E.g. when there's an error during the form submission.</p>
  
  <p>Is there any ways which we could avoid saving the $_POST variable in the log, just for certain URLs?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-02-27T09:17:04.807Z
Comments.Text: You will only see those if you have `'devMode' => true,` in your `config/general.php`
Comments.UserDisplayName: Oli
Tags: <craft3><form><logs><logging>
Title: Avoid saving $_POST in Craft logs for certain URLs
ThreadText: # Avoid saving $_POST in Craft logs for certain URLs
  
  (Asked by: username_0 on 2020-02-27)
  
  We know that Craft logs the $\_POST variable in web.log. I wonder if we have some sensitive data going through the server side (collected from a front end form), even if we don't save it in the database, it can still potentially end up in Craft's logs, isn't it? E.g. when there's an error during the form submission.
  
  Is there any ways which we could avoid saving the $\_POST variable in the log, just for certain URLs?
  
  **Tags:** craft3, form, logs, logging
  
  > **Comments:**
  > **username_1**: You will only see those if you have `'devMode' => true,` in your `config/general.php`  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2020-02-27. Score: 1 | Accepted answer
  
  As [Oli](https://craftcms.stackexchange.com/questions/33782/avoid-saving-post-in-craft-logs-for-certain-urls#comment41078_33782) commented, those will only be logged if `devMode` is enabled, which should never be the case in production.
  
  Outside of that, Craft does have a `sensitiveKeywords` propery in the Security class: <https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29> that defaults to these keywords: <https://github.com/craftcms/cms/blob/develop/src/services/Security.php#L29> and will redact those from places like log files.
  
  If you need to modify that list, you can do so from by extending the [application config](https://docs.craftcms.com/v3/config/app.html#app) like so:
  
  ```
  <?php
  return [
      'components' => [
          'security' => [
              'class' => craft\services\Security::class,
              'sensitiveKeywords' => [
                  'key1',
                  'key2',
              ],
          ],
      ],
  ];
  
  ```
  
  > **Comments:**
  > **username_0**: Thanks for clarifying, Oli and username_2, and that's a very useful tip regarding the sensitiveKeywords.  
  
  ---
  
  