Home/ Questions/Q 9221109
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-18T03:30:18+00:00

I’ve recently deployed a Flask app on Heroku. It provides an API on top

  • 0

I’ve recently deployed a Flask app on Heroku. It provides an API on top of an existing API and requires a confidential API key for the original service from the user. The app is really just a few forms, the values of which are passed with ajax to a specific URL on the server. Nothing fancy. I take steps to not store confidential information in the app and want no traces of it anywhere within the app.

Looking at the logs from heroku logs --source heroku, the heroku router process stores all HTTP requests for the app, including those requests that include the confidential information.

Is there a way to specify the log format for the heroku process so as to not store the URL served?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    As other commenters mentioned, it is a bad practice to put confidential info in a URL. These could get cached or logged by a number of systems (e.g. routers, proxy servers, caches) on the roundtrip to the server. There are a couple ways to solve this:

    • Put them in a the Authorization header. This is probably the most common way authentication is handled for REST-based APIs.

    • Put them in the POST body. This works to get it out of the URL, but is a little weird semantically to say that your are POSTing the credentials to some resource (if this a REST API), unless it is a login call.

    • 0