How to censor/hide a HOCON value from appearing in Ktor logs

Question

Using Ktor as a web server and configuring it with the (HOCON) application.conf file.

I've setup a default password for connecting to a database in the configuration, as well as the ability for it to be overridden with an environment variable.

When the server starts, the configurations is printed to the console (and probably in future stored in logs), the problem is that the password is plainly visible.

Does anyone know of a way to prevent this?

Representative application.conf:

ktor {

    deployment {
        port = 8080
        port = ${?PORT}

        databaseUrl = ${?DATABASE_URL}
        databaseUser = ${?DATABASE_USER}
        databasePassword = ${?DATABASE_PASSWORD}
        ...
    }
}

Example server output

...
# env var DATABASE_PASSWORD
"databasePassword" : "mysecretpassword",
# env var DATABASE_URL
"databaseUrl" : "jdbc:postgresql://localhost:5432/postgres",
# env var DATABASE_USER
"databaseUser" : "postgres",
...

Answer 1

You can put your parameters with sensitive values inside the security section to make them hidden inside logs. Here is an example:

ktor {
    deployment {
        port = 8085
        port = ${?PORT}
    }

    security {
        databaseUrl = ${?DATABASE_URL}
        databaseUser = ${?DATABASE_USER}
        databasePassword = ${?DATABASE_PASSWORD}
    }

    application {
        modules = [ com.example.ApplicationKt.module ]
    }
}