Skip to content

Conversation

coffeemakr
Copy link

@coffeemakr coffeemakr commented May 27, 2025

Implement the #[\SensitiveParameter] attribute (introduced in PHP 8.2) to sensitive parameters containing secret keys and confidential information to prevent exposure in stack traces.

  • Currently, when exceptions occur, stack traces include the values of method arguments, which may contain sensitive information such as secret keys.
  • Using the #[\SensitiveParameter] attribute masks confidential information in stack traces, preventing unintended information leakage in logs and error reports.
  • This library is used for authentication and encryption, so the risk of exposing secret keys is particularly serious. For example, if logs are leaked to a third party, secret keys used for JWT signatures could be exposed, potentially allowing the generation of fraudulent tokens.

I'm not sure if this is backwards compatible to PHP 8.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant