http://blogs.msdn.com/martijnh/archive/tags/PII/default.aspxTags: PIIen-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.msdn.com/martijnh/archive/2008/08/18/suppressing-personal-identifiable-information-pii-in-wcf-log-files.aspxMon, 18 Aug 2008 23:00:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:8877108martijnh1http://blogs.msdn.com/martijnh/comments/8877108.aspxhttp://blogs.msdn.com/martijnh/commentrss.aspx?PostID=8877108<P>Given the vast amount of information transported between systems in today's enterprise environments, a lot of which is considered either private (addresses, social security numbers, credit card information, mortgage and pension plans, etc) or of high business value, information security is key.</P> <P>From the release of WCF, it has brought us tremendous flexibility and allowed development teams to be almost completely agnostic of the way information is transported between point A to point B, focusing on adding business value instead.</P> <P>Another great feature WCF brings us is runtime troubleshooting. In WCF, an administrator can simply enable <A href="http://msdn.microsoft.com/en-us/library/ms731308.aspx" mce_href="http://msdn.microsoft.com/en-us/library/ms731308.aspx">logging</A> to troubleshoot an environment which is in production.</P> <P>Although a great feature for troubleshooting, Personal Identifiable Information (PII) you care about deeply while on the wire (using transport and message-level security to protect it) is available in plain text if logging is turned on at the server side.</P> <P>WCF's logging features currently filter out specific PII by default (only if the message is not <A href="http://msdn.microsoft.com/en-us/library/ms730318.aspx" mce_href="http://msdn.microsoft.com/en-us/library/ms730318.aspx">malformed</A>). However, this functionality is not exposed to the developer.</P> <P>Consider the following scenario:</P> <UL> <LI>You want the administrator to be able to monitor messages for auditing, logging or troubleshooting purposes; <LI>certain information is considered PII and should not show up in the log files.</LI></UL> <P>You could write your own logging subsystem and hook it in to your services. This takes a lot of work, is error prone, needs custom maintenance, documentation, etc.</P> <P>My proposal for the scenario:</P> <UL> <LI>Use a behavior which <UL> <LI>introspects the published <A href="http://msdn.microsoft.com/en-us/library/system.servicemodel.description.serviceendpoint.aspx" mce_href="http://msdn.microsoft.com/en-us/library/system.servicemodel.description.serviceendpoint.aspx">ServiceEndPoint</A>s for published <A href="http://msdn.microsoft.com/en-us/library/system.servicemodel.description.operationdescription.aspx" mce_href="http://msdn.microsoft.com/en-us/library/system.servicemodel.description.operationdescription.aspx">OperationDescription</A>s and the used <A href="http://msdn.microsoft.com/en-us/library/system.runtime.serialization.datacontractattribute.aspx" mce_href="http://msdn.microsoft.com/en-us/library/system.runtime.serialization.datacontractattribute.aspx">DataContract</A>s, <LI>finds public properties on the DataContract marked as PII; <LI>instructs the WCF logging runtime to ignore the contents of the specified message elements.</LI></UL> <LI>configure the behavior through code (this is not generally considered a best practice, but the security needs of the service outweighs the flexibility needs of configuration);</LI></UL> <P>Let's have a look at how the solution works:</P> <P>Take a DataContract, e.g. PurchaseOrder and apply an attribute (PII) on each property which represents PII.</P> <P><A href="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_datacontract_2.png" mce_href="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_datacontract_2.png"><IMG style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" height=174 alt=wcf_pii_datacontract src="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_datacontract_thumb.png" width=388 border=0 mce_src="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_datacontract_thumb.png"></A> </P> <P>Next, add a PIIProtectionBehavior attribute to your service implementation class</P> <P><A href="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_protectionbehavior_attribute_2.png" mce_href="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_protectionbehavior_attribute_2.png"><IMG style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" height=107 alt=wcf_pii_protectionbehavior_attribute src="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_protectionbehavior_attribute_thumb.png" width=613 border=0 mce_src="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_protectionbehavior_attribute_thumb.png"></A></P> <P>You're done. The PIIProtectionBehavior attribute is also an <A href="http://msdn.microsoft.com/en-us/library/system.servicemodel.description.iservicebehavior.aspx" mce_href="http://msdn.microsoft.com/en-us/library/system.servicemodel.description.iservicebehavior.aspx">IServiceBehavior</A> implementation which performs the introspection on the EndPoints.</P> <P>The result when logging is turned on:</P> <P><A href="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_messagelogging_2.png" mce_href="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_messagelogging_2.png"><IMG style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" height=135 alt=wcf_pii_messagelogging src="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_messagelogging_thumb.png" width=389 border=0 mce_src="http://blogs.msdn.com/blogfiles/martijnh/WindowsLiveWriter/SuppressingPersonalIdentifiableInformati_C46F/wcf_pii_messagelogging_thumb.png"></A></P> <P>As you can see, 'CreditCardnumber' is no longer logged, it just displays '&lt;-- Removed --&gt;' .</P> <P>I've attached the sample code, hope it's useful!</P> <P>Ofcourse, the normal disclaimers apply, the accompanied sample is for educational purposes only, it has not gone through rigorous testing, might contain bugs due to limited testing (me ;-)), etc. Please see the sourcecode for further remarks.</P><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8877108" width="1" height="1">WCF.NETSecurityPII