WebApp Sec: Re: IIS log

[Alejandro Flores <alejandro.flores () ipad com br>]

        Hello Justin,

        The webserver doesn't know what is a Credit Card #. I guess the
webserver is logging the GET requests like:
someINFO someDATE GET
/something/apply.asp?ccNumber=123456789&cNumber=9871 ... ...
        Change your application to POST the requests.

Regards, 
Alejandro Flores

> I just viewed an IIS log and I noticed that the credit card # is loogged.
> I beleive that this is a major flaw to log credit card # is clear text.
> Does anyone have any advice?
>
>
> Regards,
> Justin