Exceptions on login are not logged

[adragus-inviqa]

Is there a reason for not logging them? Because I think they should definitely be logged.

magento2/app/code/Magento/Customer/Controller/Account/LoginPost.php

Lines 101 to 103 in 4985ace

	$this->messageManager->addError(
	__('Something went wrong while validating the login and password.')
	);

[slavvka]

@adragus-inviqa, thank you for your notification. Please feel free to contribute it with your pull request. Thank you!

[daim2k5]

@adragus-inviqa do you like provide a PR?

[therouv]

I think the reason for not logging the exceptions here is because of a possible PA DSS validation as in the exception message can contain sensitive customer data.

M1 does not log the exceptions here as well, see https://github.com/OpenMage/magento-mirror/blob/magento-1.9/app/code/core/Mage/Customer/controllers/AccountController.php#L177

[adragus-inviqa]

Then why is this "up for grabs"? That's why I ask first.

[davidalger]

@therouv is correct… adding an exception log call here would be a PA-DSS violation - it is because the username/password are passed directly as arguments to the authenticate() method vs being passed as an object. An exception backtrace would contain the username and password in plaintext within the backtrace.

I've opened a PR to correct the error message displayed to the user and also to re-add the note which was formerly there in M1. Closing this issue page. Please reopen if you disagree with this assessment.