--- title: "Privacy-Safe Phoenix Request Logging Without Changing Controller Params" url: https://daily.dev/posts/privacy-safe-phoenix-request-logging-without-changing-controller-params-xmxxxyais source_url: https://hfiguera.github.io/obscura/blog/privacy-safe-phoenix-request-logging type: article source: "ElixirStatus" published: 2026-08-07T14:12:50.534Z updated: 2026-08-07T14:13:23.990Z tags: ["privacy", "elixir"] reading_time: 10 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Privacy-Safe Phoenix Request Logging Without Changing Controller Params **[ElixirStatus](https://daily.dev/sources/elixirstatus)** · 10 min read · 0 upvotes · 0 comments ## Summary When using Obscura's assign-mode redaction in Phoenix, placing a sanitized copy of request params in conn.assigns is not enough — Phoenix's default telemetry logger still reads conn.params and can log raw PII. The solution is Obscura.Phoenix.Logger, an opt-in telemetry handler that reads only the redacted assign and fails closed in all error paths. Installation requires three explicit steps: disabling Phoenix's default logger, adding the Obscura plug after Plug.Parsers and before the router, and supervising the telemetry handler. The handler also logs route templates instead of raw paths, validates HTTP methods, clears inherited Logger metadata, and enforces work budgets (max 64 keys, 64 KiB scalar values, 1,024 traversed values) to prevent DoS via adversarial request shapes. The post includes a deployment checklist and clearly scopes what the integration does not protect. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I prevent Phoenix from logging raw request parameters like emails and passwords in its default telemetry logger? Disable Phoenix's default logger with `config :phoenix, :logger, false`, create a redacted assign after Plug.Parsers using a plug like Obscura.Phoenix.Plug in :assign_redacted mode, then supervise a custom telemetry handler that reads only that assign. This ensures the controller still receives original params while the log record contains only the sanitized copy. The handler must fail closed — never falling back to conn.params — when the assign is missing or malformed. _Phoenix developers shipping PII-handling endpoints track patterns like this on daily.dev._ ### What are the work budget limits in Obscura.Phoenix.Logger to prevent DoS via large request bodies? The handler rejects parameter graphs exceeding any of these limits: 64 parameter keys, 4 KiB cumulative key text, 64 KiB cumulative scalar value text, 1,024 traversed values, 128 terms requiring PII analysis, and 64 decimal digits in a single number. Exceeding any budget produces a single `Parameters: "[FILTERED]"` log line with no partial output and no fallback to raw parameters. _Teams hardening Phoenix logging against adversarial inputs find the latest Elixir security patterns on daily.dev._ ### Why does Obscura.Phoenix.Logger log route templates instead of raw request paths in Phoenix? Raw URL paths can contain PII directly — for example `/users/jane@example.com/documents/4111111111111111`. The handler logs the matched Phoenix route template (e.g. `/users/:email/documents/:card_id`) instead, which preserves enough information to group and search logs without copying path parameters into every record. A route with sensitive literal text in the template itself is considered a bad route and should be fixed at the source. _Developers designing privacy-safe API routing share approaches like this on daily.dev._ ## Similar posts on daily.dev - [Privacy-Safe Phoenix Socket and Channel Logging Without Exposing Payloads](https://daily.dev/posts/privacy-safe-phoenix-socket-and-channel-logging-without-exposing-payloads-eehbwgr28) · ElixirStatus · 3 upvotes · 0 comments - [Protecting PII in Elixir Before It Reaches Logs, APIs, and LLMs](https://daily.dev/posts/protecting-pii-in-elixir-before-it-reaches-logs-apis-and-llms-lkpcth0ab) · ElixirStatus · 0 upvotes · 0 comments - [The Agent Needs Identity. The Model Does Not.](https://daily.dev/posts/the-agent-needs-identity-the-model-does-not--5tla5jnnb) · ElixirStatus · 1 upvotes · 0 comments --- Tags: [#privacy](https://daily.dev/tags/privacy), [#elixir](https://daily.dev/tags/elixir) [View this post on daily.dev](https://daily.dev/posts/privacy-safe-phoenix-request-logging-without-changing-controller-params-xmxxxyais)