Skip to content

Add SensitiveParameter attribute #1483

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

coffeemakr
Copy link

@coffeemakr coffeemakr commented May 27, 2025

Implement the #[\SensitiveParameter] attribute (introduced in PHP 8.2) to sensitive parameters containing secret keys and confidential information to prevent exposure in stack traces.

  • Currently, when exceptions occur, stack traces include the values of method arguments, which may contain sensitive information such as secret keys.
  • Using the #[\SensitiveParameter] attribute masks confidential information in stack traces, preventing unintended information leakage in logs and error reports.
  • This library is used for authentication and encryption, so the risk of exposing secret keys is particularly serious. For example, if logs are leaked to a third party, secret keys used for JWT signatures could be exposed, potentially allowing the generation of fraudulent tokens.

I'm not sure if this is backwards compatible to PHP 8.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant