> When secrets come in, immediately store them (ideally at the web framework level) ...
But, in practice, a lot of this stuff is being logged by things like proxies that could be several layers in front of the "web framework level".
But, in practice, a lot of this stuff is being logged by things like proxies that could be several layers in front of the "web framework level".
Either way, yeah, you're right - it is not a perfect solution. But it means that for any system your engineers build, so long as they build them using your web framework that imposes this password type, you can grep your codebase for bugs.
You could implement client side hashing as a best-effort "in transit" mechanism but that has obvious downsides. Not sure how I'd feel about that approach in practice, but I can't see a big downside.