Log login requests

Carefully though, to avoid logging passwords

1 files changed, 10 insertions, 0 deletions

diff --git a/synapse/rest/client/v1/login.py b/synapse/rest/client/v1/login.py

index d24590011b..7c8240a6d7 100644
--- a/synapse/rest/client/v1/login.py
+++ b/synapse/rest/client/v1/login.py
@@ -166,6 +166,16 @@ class LoginRestServlet(ClientV1RestServlet):
         Returns:
             (int, object): HTTP code/response
         """
+        # Log the request we got, but only certain fields to minimise the chance of
+        # logging someone's password (even if they accidentally put it in the wrong
+        # field)
+        logger.info(
+            "Got login request with identifier: %r, medium: %r, address: %r, user: %r",
+            login_submission.get('identifier'),
+            login_submission.get('medium'),
+            login_submission.get('address'),
+            login_submission.get('user'),
+        );
         login_submission_legacy_convert(login_submission)
 
         if "identifier" not in login_submission: